Remote opportunity at
SourcegraphCompliance Manager [IC3]
Sourcegraph is hiring a Compliance Manager to take charge of its governance, risk and compliance work, with compliance as the main concern. The company builds tools…
Career Tools
About This Role
Sourcegraph is hiring a Compliance Manager to take charge of its governance, risk and compliance work, with compliance as the main concern. The company builds tools that show engineering organizations how large, multi-repository codebases fit together and supply context for AI agents working in them. Sourcegraph is spread across the globe, recruits in most regions, and favors candidates in the USA. The job focuses on SOC 2 and ISO 27001.…
Job Description
Sourcegraph is hiring a Compliance Manager to take charge of its governance, risk and compliance work, with compliance as the main concern. The company builds tools that show engineering organizations how large, multi-repository codebases fit together and supply context for AI agents working in them. Sourcegraph is spread across the globe, recruits in most regions, and favors candidates in the USA.
The job focuses on SOC 2 and ISO 27001. The manager carries these certifications from start to finish: designing and tailoring controls, gathering evidence, teaching internal teams, dealing with auditors directly, and driving remediation to closure. Work is cross-functional, spanning security, engineering, IT, legal, people operations and sales. Milestones: during month one, build relationships and understand the current program; by month three, take over day-to-day SOC 2 and ISO 27001 operations and customer security questionnaires; by month six, lead an audit or certification milestone and publish a forward-looking compliance roadmap.
Candidates need five or more years in governance, risk, compliance or security compliance, including hands-on management of the SOC 2 and ISO 27001 efforts from first step to last at a SaaS or quick-moving tech firm. Enough technical grounding to discuss cloud systems, access control and software work with engineers and auditors is important. The role is leveled IC3. Base pay depends on the band for the candidate's location zone; starting figures are listed as $137,718 for Zone 2 and $102,899 for Zone 3. Candidates must be able to overlap with GMT-3 working hours for a minimum of 20 hours weekly. Expect roughly five hours of interviews in total.
Responsibilities
- Lead the GRC program with compliance outcomes as the top priority.
- Keep SOC 2 and ISO 27001 current and prepare for further frameworks as the business expands.
- Design and adjust controls, gather evidence, train internal staff and deal directly with auditors.
- Drive audit findings through to resolution.
- Keep the risk log, ISMS procedures, company policies and compliance files current.
- Answer security questionnaires and compliance questions from prospects and customers.
- Run the ISMS meeting cadence, control reviews and audit preparation.
- Produce a forward-looking roadmap covering renewals, audits and new frameworks.
Requirements
- Five or more years in GRC, information security compliance or a similar role.
- Practical running of SOC 2 plus ISO 27001 efforts from beginning to end, ideally at a SaaS or fast-moving tech company.
- Experience managing external audits and certifications, from preparation through follow-up.
- Solid background in managing risk, designing controls, ISMS oversight and day-to-day compliance operations.
- Skill at adapting controls to a real environment rather than applying generic rules.
- Familiarity with cloud platforms and the compliance needs of a distributed workforce.
- Strong project management and clear communication with technical and non-technical people.
- Willingness to do the hands-on compliance work personally.
Qualifications
- Experience with other frameworks such as GDPR, HIPAA, FedRAMP or PCI DSS.
- Experience with security questionnaires, customer assurance or sales-facing compliance.
- Experience with GRC software, compliance automation or evidence-collection tooling.
- Certifications like CISA or CISSP, an ISO 27001 lead implementer or auditor credential, or CRISC.
- Interest in AI and automation for compliance work.
Core Skills
Benefits
- Equity as part of pay.
- Perks and benefits described only in general terms in the posting.
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
Yes. Sourcegraph recruits across most regions and prefers USA candidates. Working time must overlap GMT-3 for a minimum of 20 hours weekly.
What is the pay?
Base pay follows the IC3 band for your location zone. Listed starting salaries are $137,718 (Zone 2) and $102,899 (Zone 3).
How long is the interview process?
About five hours in total across screens, a working assignment, technical and values interviews, and a leadership round.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.