Security & Privacy Program Lead (SOC2, GDPR) — Remote

Credo Screening; United States; Remote; USD 90,000 - 140,000; Full time

Benefits offered by this job

Competitive salary + equity

Unlimited PTO

Remote-first culture

Home office stipend

Company offsites

Job summary

Credo Screening is seeking a Security & Privacy Analyst to build and operationalize its security and privacy compliance programs from the ground up. This hands-on role involves defining policies, building processes, and engaging with customers to demonstrate data handling with the highest standards.

You'll own SOC 2, GDPR/CCPA, and privacy-by-design, work with engineering on secure development, and coordinate audits with external testers and auditors. Remote-first, US/Canada.

Qualifications

• 3–6 years in security, privacy, compliance, or risk management.
• Experience building or contributing to SOC 2, ISO 27001, or similar programs.
• Familiarity with GDPR, CCPA/CPRA, biometric data laws (BIPA or similar).
• Understanding of cloud security fundamentals across major providers.
• Experience completing security questionnaires for enterprise customers.
• Ability to work cross-functionally with engineering, legal, and leadership.
• Strong documentation skills and policy-writing ability.

Responsibilities

• Build and maintain Credo's security and privacy programs (SOC 2, GDPR, CCPA/CPRA).
• Implement and monitor security controls across infrastructure, apps, and data.
• Lead security and privacy audits, assessments, and certifications.
• Own customer security questionnaires, vendor assessments, and due diligence reviews.
• Define data handling policies for biometric data, government IDs, and PII.
• Collaborate with engineering on secure development—encryption, access controls, key management, data retention.
• Manage biometric data lifecycle with encryption during verification and deletion when complete.
• Identify risks and drive remediation across the platform.
• Develop security documentation—policies, procedures, IR plans, DPA.
• Support customer inquiries about our security posture; monitor privacy laws.
• Coordinate with auditors, pen-testers, and security vendors.

Skills

SOC 2

ISO 27001

privacy compliance

risk management

privacy regs (GDPR/CCPA/CPRA)

cloud security

security questionnaires

cross-functional collaboration

documentation

Tools

GCP

AWS

Azure

Job description

Credo Screening is seeking a Security & Privacy Analyst to build and operationalize its security and privacy compliance programs from the ground up. This hands-on role involves defining policies, building processes, and engaging with customers to demonstrate data handling with the highest standards.

You'll own SOC 2, GDPR/CCPA, and privacy-by-design, work with engineering on secure development, and coordinate audits with external testers and auditors. Remote-first, US/Canada.