Remote Security Compliance Lead - SOC 2, PCI, ISO 27001

Sardine; United States; On-site; USD 140,000 - 230,000; Full time

Benefits offered by this job

Remote-first culture

Health insurance

401k / RRSP matching

MacBook Pro provided

Home office setup stipend

Job summary

Sardine is seeking a Security Compliance Lead to own our security compliance and GRC program end-to-end, reducing risk through collaboration with engineering, IT, product, security, and legal. You’ll be the primary contact for auditors and regulators and will mentor a growing team as Sardine scales.

This senior, hands-on role requires ownership of program design, ongoing readiness for audits, and the ability to articulate business impact of control gaps to executives.

Qualifications

• 7+ years in security compliance, GRC, or audit with end-to-end ownership of audit or certification programs (SOC 2, PCI DSS, and/or ISO 27001).
• Deep knowledge of security and privacy frameworks (PCI DSS, SOC 2, ISO 27001, GDPR/CCPA, DORA) and related control frameworks (NIST CSF, CIS).
• Technical and product fluency to ground control design in the platform and collaborate with engineering and product teams.

Responsibilities

• Own compliance planning and the program across SOC 2 Type II, PCI DSS Level 1, ISO 27001, GDPR/CCPA, and DORA.
• Drive FedRAMP effort, coordinate control implementation, 3PAO assessment, and continuous monitoring with engineering and IT.
• Interface with auditors, regulators, and stakeholders; lead reviews with cross-functional teams.
• Present objectives and results to senior management and the board with clear business impact.
• Own the risk picture, risk register, and reporting cadence; ensure actions address risks appropriately.
• Lead customer assurance programs— security questionnaires, attestations, and trust artifacts.

Skills

Security compliance

GRC

Audit programs

Regulatory knowledge

Technical fluency

Communication

Leadership

Travel flexibility

Tools

Vanta

Rippling

GRC tooling

Job description

Sardine is seeking a Security Compliance Lead to own our security compliance and GRC program end-to-end, reducing risk through collaboration with engineering, IT, product, security, and legal. You’ll be the primary contact for auditors and regulators and will mentor a growing team as Sardine scales.

This senior, hands-on role requires ownership of program design, ongoing readiness for audits, and the ability to articulate business impact of control gaps to executives.