Compliance & Security Lead

This is a fully remote position, open to applicants in United Kingdom.

📋 Description

• Take charge of security compliance and data protection at Trigger.dev.

• Report directly to the founders and collaborate closely with the engineering team.

• Manage the SOC 2 and HIPAA compliance programs.

• Oversee the SOC 2 audit and coordinate evidence collection using Oneleet.

• Leverage AI and automation to streamline questionnaire responses, evidence gathering, and policy evaluations.

• Complete security questionnaires and conduct vendor assessments.

• Distribute security reports and bridge letters.

• Maintain the trust portal effectively.

• Review and negotiate Data Processing Agreements (DPAs) with both customers and suppliers in collaboration with legal counsel.

• Keep records of data processing and manage UK and EU GDPR data subject requests.

• Author and update security, privacy, and data retention policies.

• Ensure adherence to retention periods.

• Evaluate new tools and subprocessors and keep the subprocessor list current.

• Determine the necessity for frameworks such as ISO 27001 or ISO 42001 and lead their implementation.

• Provide onboarding training and establish straightforward compliance processes.

• Annually maintain and test incident response and breach notification protocols.

⛳️ Requirements

• A minimum of 5 years in security compliance, GRC, or data protection, preferably within a SaaS or developer tools environment.

• Experience at an early-stage startup as the primary or sole compliance hire, with complete ownership of compliance functions.

• Practical experience managing a SOC 2 audit, from evidence collection to the final report.

• Up-to-date understanding of UK and EU GDPR regulations.

• Proven experience in reviewing or negotiating DPAs.

• Ability to complete security questionnaires promptly and accurately.

• Exceptional writing skills with a focus on clarity.

• Technical knowledge of cloud infrastructure, access control, and logging; coding skills not required.

• If working remotely, must be located within CET to ET time zones (GMT+1:00 to GMT-5:00).

• Experience with ISO 27001 or HIPAA is preferred.

• Familiarity with Oneleet, Vanta, or Drata is preferred.

• Possession of privacy or security certifications such as CIPP/E, CISA, or CISSP is preferred.

• Experience utilizing AI tools for questionnaires, evidence analysis, and policy-related work is preferred.

• Based in the UK and able to attend team meetings in London is preferred.

🏝️ Benefits

• Competitive compensation package and equity options.

• Flexible asynchronous working environment.

• Provision for home office equipment.

• Comprehensive private health insurance, including Vitality for the UK team.

• A pet-friendly office in London for dogs and cats.

• 25 days of vacation, not including national holidays.

• Paid sick leave.

• Generous parental leave policy.

• Annual budget for training and development.

• Company pension scheme or direct contributions to a private pension plan.