Security Trust & Compliance Lead — Audits & Automation

Klaviyo Inc.; Denver, Northern (CO, KY); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Klaviyo is seeking a Lead Security Trust & Compliance Engineer to own multiple programs, including audits, control design, and policy management. You will lead end-to-end efforts, guide engineers, and raise the security bar across a modern SaaS platform.

You’ll partner with internal teams, define health metrics, automate workflows, and stay ahead of evolving frameworks such as NIST, ISO, GDPR. This role offers high-impact work with strong collaboration and opportunities for growth.

Qualifications

• Deep experience assessing, designing, and monitoring security and privacy controls across SaaS platforms.
• Track record owning security audit programs end to end with auditor interactions.
• Experience writing precise policies and standards with clear ownership and review processes.
• Knowledge of enterprise SaaS, cloud infrastructure, databases, and secure network design.
• Experience with GRC engineering and security automation, especially AI to reduce toil.
• Familiarity with security automation platforms and AI governance concepts.

Responsibilities

• Own internal and external audits and examinations end to end from scoping and readiness through fieldwork and evidence delivery; act as our primary point of contact for auditors and assessors, and develop action plans to correct findings and exceptions
• Identify gaps against frameworks we do not yet meet, define the strategy to close them, and drive the implementation when Klaviyo takes on a new certification or regulation
• Own security policies and standards end to end — author and maintain the policy, standard, and procedure hierarchy, decompose standards into testable requirements mapped to frameworks, and run the review, ratification, and exception management
• Determine control design and implementation details for net-new controls, provide technical guidance to partner teams on control design best practices, and diagnose deficiencies by reviewing system configurations, technical documentation, security tool data, and occasionally application code
• Define control health metrics and build the pipelines behind them from the systems we already run, so control health is a live signal rather than a quarterly assertion
• Automate and streamline our Security Trust & Compliance workflows — control testing, continuous control monitoring, evidence collection, identity governance, and security Q&As for employees and customers — with a penchant for creating excellent self-service experiences
• Proactively identify internal and external risks and opportunities relevant to our Trust & Compliance programs, and propose the plans to address them

Skills

NIST CSF 2.0

Audit management

Policy writing

GRC engineering

AI automation

Cloud AWS

Kubernetes

SOC 2

ISO 27001

ISO 27017

PCI

HIPAA

ISO 27701

ISO 42001

CISA

CISSP

Tools

Terraform

OPA/Rego

Conftest

REST APIs

Python

Job description

Klaviyo is seeking a Lead Security Trust & Compliance Engineer to own multiple programs, including audits, control design, and policy management. You will lead end-to-end efforts, guide engineers, and raise the security bar across a modern SaaS platform.

You’ll partner with internal teams, define health metrics, automate workflows, and stay ahead of evolving frameworks such as NIST, ISO, GDPR. This role offers high-impact work with strong collaboration and opportunities for growth.