Senior Privacy & Security Compliance Lead

Deepgram; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Deepgram is hiring a Compliance and Documentation Lead to own the privacy and security evidence backbone across SOC 2, ISO 27001, and PCI DSS. You will craft accurate DPIAs, data flow maps, and governance documents used by auditors, enterprise customers, and engineers.

You will partner with Legal, Security Engineering, and Solutions/Sales Engineering to ensure statements are verifiable and aligned with deployment models (hosted, dedicated, self-hosted).

Qualifications

• Substantial experience in privacy operations, security compliance, or technical compliance documentation.
• Exceptional writer capable of producing auditable, customer-facing documents.
• Experience building data maps, DSAR workflows, and evidence libraries.
• Hands-on involvement in at least one formal audit (SOC 2, ISO 27001, or PCI DSS).
• Knowledge of GDPR/CCPA and evolving AI regulation.

Responsibilities

• Own privacy risk assessments, DPIAs, and transfer impact assessments end to end.
• Maintain data flow maps and records of processing across deployment models.
• Oversee privacy controls operating model: retention, DSAR, deletion, consent handling, redaction.
• Manage subprocessor and vendor privacy reviews and DPAs.
• Translate privacy laws into concrete requirements for GTM and engineering teams.
• Own audit evidence for SOC 2, ISO 27001, and PCI DSS and coordinate with auditors.

Skills

Privacy operations

Technical writing

Audit readiness

GDPR/CCPA

Data mapping

Vendor due diligence

Policy drafting

Cross-functional work

Job description

Deepgram is hiring a Compliance and Documentation Lead to own the privacy and security evidence backbone across SOC 2, ISO 27001, and PCI DSS. You will craft accurate DPIAs, data flow maps, and governance documents used by auditors, enterprise customers, and engineers.

You will partner with Legal, Security Engineering, and Solutions/Sales Engineering to ensure statements are verifiable and aligned with deployment models (hosted, dedicated, self-hosted).