Remote Compliance Engineering Lead — Automate Security

Socket; Northern (KY); Hybrid; USD 150,000 - 230,000; Full time

Benefits offered by this job

Equity program

Comprehensive health benefits

Remote-first with team off-sites

Flexible time-off

Job summary

Socket is hiring a Compliance Engineering Lead to own compliance as an engineered system, not just reminders. You will direct SOC 2 Type II cycles, drive ISO 27001 certification, and automate evidence collection across GCP, GitHub, identity providers, and MDM.

You will report to the CISO, hire a trusted security questionnaire lead, and shape Socket's GRC program while balancing enterprise requirements with a fast-moving, remote-first environment.

Qualifications

• Own two full SOC 2 Type II cycles including auditor relationships.
• ISO 27001 certification or ISMS management experience.
• Build automations against services (GCP, GitHub, identity provider, MDM).
• Hands-on experience with Drata, Vanta, or similar platforms.
• Prioritize real risk vs auditor formatting preferences.
• Excellent writing for auditors, engineers, and executives.
• Experience in a remote, fast-moving environment.
• Nice to Have: exposure to AI governance frameworks.

Responsibilities

• Own SOC 2 Type II end-to-end, including the evidence pipeline and auditor relationship.
• Lead ISO 27001 certification efforts and keep ISMS alive post-certification.
• Make evidence collection continuous and automated from systems of record.
• Turn risk management and vendor risk into working programs with clear risk registers.
• Own the customer-facing assurance surface and build a library of artifacts.
• Scope AI assurance posture and evaluate standards to commit to.

Skills

SOC 2 Type II ownership

ISO 27001 depth

Automation

Auditing & reporting

Prioritization skills

Clear communication

Experience in remote environment

Tools

Drata

Vanta

GCP

GitHub

Identity provider

MDM

Job description

Socket is hiring a Compliance Engineering Lead to own compliance as an engineered system, not just reminders. You will direct SOC 2 Type II cycles, drive ISO 27001 certification, and automate evidence collection across GCP, GitHub, identity providers, and MDM.

You will report to the CISO, hire a trusted security questionnaire lead, and shape Socket's GRC program while balancing enterprise requirements with a fast-moving, remote-first environment.