Senior Security Compliance & Certification Lead

Rubrik; Richmond (VA); Remote; USD 135,000 - 203,000; Full time

Job summary

Rubrik seeks a Senior Commercial Compliance Analyst to own end-to-end audits and certifications across SOC 1/2 and ISO programs. You will coordinate scoping, evidence gathering, and remediation with external auditors, while mapping controls to sources for continuous readiness.

You will drive strategy to reduce duplicate requests, oversee lifecycle management of certifications, and collaborate with InfoSec, IT, Legal, and Engineering to meet regulatory requirements for enterprise SaaS and AI

Qualifications

• 5+ years of experience in security compliance, audit management, or GRC.
• Hands-on in SOC 2, ISO 27001, ISO 42001 audits plus at least one additional framework.
• Experience working with external auditors and certification bodies, including scoping and timelines.
• Strong project management across multiple audit cycles.
• Familiar with GRC tooling and Jira for tracking evidence and remediation.
• Excellent written and verbal communication.
• Knowledge of regulatory requirements for enterprise SaaS/security vendors.
• Detail-oriented work ethic.

Responsibilities

• Own the audit and certification calendar across Rubrik's active portfolio: SOC 1, SOC 2, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, CSA STAR Level 1 and Level 2, TISAX Level 1 and Level 2, HITRUST, HIPAA.
• Primary contact for external auditors and certification bodies, managing scoping, fieldwork, evidence requests, and remediation through to closure.
• Maintain mapping between compliance controls and evidence sources for continuous audit readiness.
• Drive coordinated audit strategy to consolidate overlapping evidence requests and reduce duplicate work.
• Lead evaluation and scoping of new certifications to support Rubrik's international and AI governance expansion.
• Manage the lifecycle of certifications end-to-end, including retirements and transitions.
• Track and report audit status, findings, and remediation progress via Jira dashboards.
• Collaborate with control owners across InfoSec, IT, Legal, and Engineering to gather evidence and close findings on schedule.
• Coordinate with Risk Management to feed audit findings into the risk register and remediation lifecycle.
• Support Customer Trust Enablement by making outputs readily usable to answer customer inquiries.
• Leverage AI and automation to streamline evidence gathering, testing, and audit workflows.

Skills

Security compliance

Audit management

GRC

SOC 2

ISO 27001

External auditors liaison

Project management

Jira

Regulatory knowledge

Attention to detail

Communication

Tools

Jira

Job description

Rubrik seeks a Senior Commercial Compliance Analyst to own end-to-end audits and certifications across SOC 1/2 and ISO programs. You will coordinate scoping, evidence gathering, and remediation with external auditors, while mapping controls to sources for continuous readiness.

You will drive strategy to reduce duplicate requests, oversee lifecycle management of certifications, and collaborate with InfoSec, IT, Legal, and Engineering to meet regulatory requirements for enterprise SaaS and AI