Security Compliance Lead: SOC 2, PCI, ISO 27001 (Remote)

Sardine; New York (NY); Remote; USD 145,000 - 200,000; Full time

Benefits offered by this job

Remote-first culture

Home office setup stipend

MacBook Pro

Meal stipend

Annual learning stipend

Wellness stipend

401k match

Job summary

Sardine is seeking a Security Compliance Lead to own our security compliance and GRC program end-to-end. You will be the primary liaison to auditors and regulators, partnering with engineering, IT, product, security, and legal to run audits across SOC 2 Type II, PCI DSS, ISO 27001, GDPR/CCPA, and DORA.

This senior, hands-on role lets you design the program, grow the team (starting with a Security Compliance Analyst), and keep Sardine audit-ready as regulations evolve.

Qualifications

• 7+ years in security compliance, GRC, or audit with end-to-end ownership of audit or certification programs (SOC 2, PCI DSS, and/or ISO 27001).
• Deep knowledge of PCI DSS, SOC 2, ISO 27001, GDPR/CCPA, and DORA; familiarity with NIST CSF and CIS.
• Technical and product fluency to engage engineering and product teams on security controls.
• Excellent communication with auditors, regulators, and leadership; executive-ready documentation.
• Fast-paced fintech/payments experience preferred due to PCI Level 1 obligations.
• Able to lead, partner, and contribute as needed and travel as required.
• People leadership experience or readiness to manage a direct report.

Responsibilities

• Own compliance planning and the program design across SOC 2 Type II, PCI DSS Level 1, ISO 27001, GDPR/CCPA, and DORA.
• Drive FedRAMP effort with NIST SP 800-53, 3PAO, and continuous monitoring across engineering and IT.
• Interface with auditors, regulators, and stakeholders and partner across engineering, IT, product, security, and legal.
• Present objectives, scope, and results to senior management and the board with business impact of controls.
• Own the control framework, policy library, and risk picture including the risk register and reporting cadence.
• Build product and technical fluency to ground control design in Sardine’s architecture.
• Lead and develop the team starting with a Security Compliance Analyst and scale the function.
• Coordinate evidence, scans, and artifacts; drive process improvements from findings.

Skills

Security compliance

GRC

Audits

Regulatory frameworks

Communication

Leadership

Fintech/payments knowledge

Tools

Vanta

Rippling

macOS

Job description

Sardine is seeking a Security Compliance Lead to own our security compliance and GRC program end-to-end. You will be the primary liaison to auditors and regulators, partnering with engineering, IT, product, security, and legal to run audits across SOC 2 Type II, PCI DSS, ISO 27001, GDPR/CCPA, and DORA.

This senior, hands-on role lets you design the program, grow the team (starting with a Security Compliance Analyst), and keep Sardine audit-ready as regulations evolve.