Security Compliance Lead: Audit, Policy & Automation

Klaviyo; Denver, Northern (CO, KY); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Klaviyo seeks a Lead Security Trust & Compliance Engineer to own multiple programs, including audits, controls design, and evidence pipelines, advancing our security posture.

You will guide frameworks like NIST, ISO, GDPR, and PCI, set strategy, and mentor analysts while delivering pragmatic, self-service security solutions across a SaaS platform.

This role involves collaboration across teams, building live control health metrics, and expanding automation to reduce toil.

Qualifications

• In-depth knowledge of security & privacy frameworks (NIST CSF 2.0, CIS, ISO 27001/27002/27017/27018/27701, SOC 1/2, PCI, HIPAA, SOX ITGCs, GDPR/CCPA/CPRA)
• Experience owning security/privacy audit programs end to end (scoping, walkthroughs, findings)
• Experience writing precise security policies and standards with clear ownership and exception processes
• Deep experience designing, assessing, and monitoring modern security controls; diagnosing deficiencies from configurations, docs, and code
• Experience with GRC engineering and security automation; applying AI to reduce toil
• Knowledge of enterprise SaaS, cloud (AWS) and Kubernetes, databases, OS, secure network design
• Experience owning programs against defined KPIs and SLAs; ability to lead without formal authority
• Strong interpersonal and communication skills to collaborate across teams

Responsibilities

• Own audits end to end—from scoping to evidence delivery; be the primary liaison for auditors.
• Define strategy to close gaps against frameworks and drive certification or regulation efforts.
• Own security policies and standards end-to-end; decompose into testable requirements.
• Determine control design and implementation; guide partner teams on best practices.
• Define control health metrics and build live pipelines for ongoing visibility.
• Automate workflows for testing, monitoring, evidence collection, identity governance, and security Q&A.
• Identify internal/external risks and propose plans to address them.

Tools

AWS

Kubernetes

Job description

Klaviyo seeks a Lead Security Trust & Compliance Engineer to own multiple programs, including audits, controls design, and evidence pipelines, advancing our security posture.

You will guide frameworks like NIST, ISO, GDPR, and PCI, set strategy, and mentor analysts while delivering pragmatic, self-service security solutions across a SaaS platform.

This role involves collaboration across teams, building live control health metrics, and expanding automation to reduce toil.