Fractional Compliance Lead

Go Fractional; United States; Remote; GBP 42,000 - 66,000; Part time

Benefits offered by this job

Competitive contractor rate

Job summary

Soda is seeking a part-time, remote compliance lead to own and evolve its SOC 2 Type II and SOC 3 program. You will push automation, build AI-assisted workflows, and streamline evidence gathering while maintaining audit readiness.

The role is EU-time-zone friendly, 2–3 days per week, and emphasizes pragmatic controls that scale with a fast-moving SaaS environment. You will partner with engineering, product, and security teams to ensure compliance without slowing product velocity, and you will be

Qualifications

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company.
• Hands-on with a SOC 2 Type II cycle and working with an external auditor.
• Hands-on with a compliance automation platform (Drata preferred).
• Designing and implementing automations, including with AI.
• Experience with AWS, Okta, GitHub, endpoint management.
• Ability to answer enterprise security questionnaires and handle live security reviews.
• Fluent written and spoken English; ability to write clear policies.
• Available roughly 2–3 days per week with CET overlap; EU time zone.
• Able to invoice as a freelancer / contractor.

Responsibilities

• Automate and simplify the compliance program to save engineers time.
• Advance the compliance posture to keep pace with AI-enabled operations.
• Make RFP and security-questionnaire responses hyper-efficient.
• Own the SOC 2 Type II and SOC 3 cycles with external auditor.
• Maintain audit-ready controls year-round and oversee onboarding/offboarding.
• Be Sales' compliance partner in enterprise security reviews.

Skills

SOC 2 Type II

Automation

AI workflows

Policy writing

Stakeholder management

English proficiency

Tools

Drata

Vanta

Secureframe

AWS

Okta

GitHub

Job description

The job

We're looking for someone to own Soda's compliance function and keep building it. We've already built a strong foundation: we've been running a SOC 2 cycle since 2021, and have been making strides in automating and professionalizing the entire compliance process in the past year. But we aren't where we want to be yet. You will be pushing this further: maximizing automation and streamlining processes, so we get even better compliance, while minimizing time our engineers and ops team have to spend on manual execution and evidence gathering.

Soda's product and operations are evolving at lightning speed. You will be the person to find pragmatic ways to make sure we keep our compliance commitments without slowing us down.

If your instinct when you see a manual process is to ask what should be doing this instead of a person, this is a good role for you.

What you'll do

Build the structure. Roughly half of this job is making compliance at Soda easier and more reliable to run:

• Push the automation of our compliance program as far as it can go. We've already got a compliance automation platform, lots of controls are already fully or partially automated. Your job is to take that even further. Every minute you give back to our engineers by taking away manual tasks is a minute they can spend building a better product instead.
• Build compliance that enables the future. Soda is leveraging the massive capabilities of AI both in its product and in its internal operations. Our processes and controls need to keep up with the new world. You will adapt our compliance posture to this fast pace of change, with pragmatic solutions that keep/improve our compliance commitments without dragging down our speed in the market.
• Make our RFP and security-questionnaire answering hyper efficient. Compliance and security are important topics in every RFP and supplier due diligence process. You will make sure this is handled as efficiently as possible, using and expanding our existing tooling and making sure the most up-to-date references are used at all times.

And make it run. The other half is the programme itself, which has to stay audit-ready while you improve it:

• Own the annual SOC 2 Type II and SOC 3 cycle with our external auditor: planning, access, samples, our part of the report, and closing out findings.
• Keep the control set audit-ready all year: watch what's lapsing, chase what's failing, make sure nothing falls through the cracks.
• Run people compliance: the compliance steps in onboarding and offboarding, plus the yearly security training, code of conduct, incident-reporting and phishing cycles.
• Be Sales' compliance partner in enterprise security reviews, unblocking deals without promising things we don't do.

Who we're looking for

You've run a SOC 2 program or similar before at a SaaS company. You're comfortable being the only compliance person in the room and pragmatic about designing controls that work for a company our size.

Two things make or break this role. First, a lot of it is getting busy engineers to do something on time and prove they did it. You need to manage that, and find ways of making this as low-friction as possible for everyone involved. Second, you have to be able to build: not production software, but scripts, integrations, prompts, and AI-assisted workflows that hold up under an auditor's questions.

Because it's part-time and remote, we need someone predictable and self-directed, who runs their own agenda and flags early when something needs a decision from us.

Requirements

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company
• You have run a SOC 2 Type II cycle hands-on, including working directly with an external auditor through scoping, sampling and remediation
• Hands-on with a compliance automation platform: Drata ideally, or Vanta / Secureframe. You know what these tools genuinely automate and where they still need a person.
• Comfortable designing and implementing automations, including with AI
• Comfortable with the systems these controls run against: AWS, Okta, GitHub, endpoint management. Enough to judge whether evidence is real, not just whether a file was uploaded.
• Comfortable answering enterprise security questionnaires and holding your own live in a customer security review
• Clear written and spoken English, and the judgement to write a policy people can actually follow
• Available roughly 2–3 days per week, with solid working-hours overlap with CET
• Must be working in an EU time zone
• Able to invoice as a freelancer / contractor

Nice to have

• Technical experience
• Experience in a company under 200 people, where compliance is one person plus a lot of automation
• ISO 27001 experience
• A certification such as CISA, CISM, CIPP/E or ISO 27001 Lead Implementer

Benefits

• A real mandate to build a modern, forward‑looking compliance system that keeps pace with and leverages opportunities created by the new AI reality
• A live, certified programme with enterprise customers depending on it, with full freedom to implement improvements
• A documented starting point: runbooks for every manual control, a scheduling system that tells you what's due, and a full written handover from your predecessor
• An AI-forward company that will actually fund and use what you build
• Direct access to decision‑makers; no layers between you and the people who can fix things
• A competitive contractor rate