Remote opportunity at
SocketCompliance Engineering Lead
Socket builds tools that help engineering and security teams safely find, audit, and manage open-source code. The company has raised $125 million in funding from prominent…
Career Tools
About This Role
Socket builds tools that help engineering and security teams safely find, audit, and manage open-source code. The company has raised $125 million in funding from prominent investors and serves well-known organizations. To support its growth and meet rigorous enterprise standards, Socket is hiring a Compliance Engineering Lead to manage compliance through automated systems rather than manual reminders. Reporting directly to the CISO, this foundational role takes full ownership of the…
Job Description
Socket builds tools that help engineering and security teams safely find, audit, and manage open-source code. The company has raised $125 million in funding from prominent investors and serves well-known organizations. To support its growth and meet rigorous enterprise standards, Socket is hiring a Compliance Engineering Lead to manage compliance through automated systems rather than manual reminders. Reporting directly to the CISO, this foundational role takes full ownership of the compliance program end-to-end, including SOC 2 Type II and ISO 27001 certifications. The ideal candidate treats evidence collection as an automated pipeline, writes code against APIs, and evaluates compliance platforms and AI assurance frameworks.
This position requires an individual who builds automated control tests, handles auditor relationships, and scales customer-facing trust operations. The Compliance Engineering Lead will also recruit and guide their first teammate focused on security questionnaires and RFPs. Candidates should thrive in a fast-moving, remote environment and possess clear opinions on GRC tooling. Socket provides comprehensive healthcare with extensive coverage, meaningful equity, flexible time off, paid parental leave, and quarterly team gatherings.
Responsibilities
- Manage SOC 2 Type II end-to-end, covering the observation window, auditor relationship, scoping, and the evidence pipeline
- Lead the organization through ISO 27001 certification, define the ISMS, conduct gap assessments, and maintain the ISMS post-certification
- Build and maintain automated evidence collection from systems of record including GCP, GitHub, identity providers, MDM, and ticketing tools
- Establish control monitoring to alert on drift immediately
- Maintain a functional risk register and manage third-party vendor risk alongside an external security partner
- Launch and maintain a trust portal and artifact library to minimize customer questionnaire load
- Scope the company AI assurance posture by evaluating frameworks such as ISO/IEC 42001, AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework
Requirements
- Personally owned at least two full SOC 2 Type II cycles as the accountable person, including scoping, evidence, and auditor relations
- Experience taking an organization through ISO 27001 certification or managing an ISMS through surveillance audits
- Demonstrated ability to build and maintain automations against services rather than relying on manual calendar reminders
- Hands-on experience with compliance platforms such as Drata or Vanta
- Ability to prioritize control gaps based on real risk versus auditor preferences
- Strong writing skills suitable for auditors, security reviewers, engineers, and executives
- Experience working in a fast-paced, remote environment
Qualifications
- Exposure to AI governance frameworks such as ISO/IEC 42001, NIST AI RMF, and the EU AI Act
- Experience working at a security vendor or another company held to a high customer bar
- Background in contract security review alongside legal teams
- History of building compliance automation in-house rather than purchasing it
Core Skills
Benefits
- Market competitive salary bands
- Meaningful equity program
- Comprehensive health benefits for employees and families with 99 percent coverage
- Flexible time-off, holidays, and a winter shutdown
- Paid parental leave
- Quarterly team off-sites in a remote-first work environment
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting specifies that the role is remote-first.
What is the employment type?
The posting specifies that this is a full-time position.
What is the salary for this role?
The posting does not specify a concrete salary, though it notes that market competitive salary bands are offered.
Who will this role report to?
The Compliance Engineering Lead reports directly to the CISO.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.