Security GRC Lead — SOC 2 & ISO Programs

Plaid; North Carolina; On-site; USD 141,000 - 259,000; Full time

Job summary

Plaid is seeking a Security Compliance Lead to own the core security compliance program, including SOC 2 Type 2, ISO 27001, and ISO 27701. You’ll drive structure, roadmap, KPIs, and ensure audits run on time as Plaid grows.

You’ll build a control catalog, align product roadmaps with audit scope, and use AI and automation to scale evidence, testing, and requests. You’ll partner with Product and Engineering and translate customer and regulator obligations into concrete controls.

Qualifications

• Has owned SOC 2 Type 2 and ISO 27001/27701 programs across multiple audits.
• Built or rebuilt a common control framework mapped across multiple frameworks.
• Hands-on FedRAMP experience (Rev5 or 20x) with NIST 800-53 control and SSP.
• Experienced in internal audits, policy assurance, ITGC, and SOX.
• Partnered with Product and Engineering to scope launches into audits.
• AI-first approach with automated evidence workflows.

Responsibilities

• Own the compliance program and governance calendar; lead end-to-end SOC 2 Type 2, ISO 27001, ISO 27701.
• Build and maintain a single control catalog mapped to all frameworks Plaid reports against.
• Run internal audit and policy assurance; track findings to remediation with Finance on ITGCs.
• Set direction, roadmaps, and KPIs; report progress to security leadership quarterly.
• Embed GRC by design; align product roadmaps and infrastructure with audits.
• Scale through AI and automation for evidence, testing, scoping, and audit requests.

Skills

Compliance ownership

FedRAMP

Internal audit

Policy assurance

ITGC & SOX

GRC governance

AI automation

Job description

Plaid is seeking a Security Compliance Lead to own the core security compliance program, including SOC 2 Type 2, ISO 27001, and ISO 27701. You’ll drive structure, roadmap, KPIs, and ensure audits run on time as Plaid grows.

You’ll build a control catalog, align product roadmaps with audit scope, and use AI and automation to scale evidence, testing, and requests. You’ll partner with Product and Engineering and translate customer and regulator obligations into concrete controls.