Security Compliance Lead

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of Plaid’s primary security compliance program, which encompasses SOC 2 Type 2, ISO 27001, and ISO 27701.

• Establish the program’s framework, direction, roadmap, and key performance indicators (KPIs).

• Lead the governance responsibilities on an annual and quarterly basis, which include policy management, access control, change management, training, vendor evaluations, regulatory compliance, as well as reviews with banks and partners.

• Create and sustain a common control catalog aligned with various frameworks, including FedRAMP and the depth of NIST 800-53.

• Designate control owners, oversee quarterly certifications, and manage testing procedures.

• Develop and implement a risk-focused internal audit strategy.

• Oversee the lifecycle of policies and monitor findings until they are resolved.

• Collaborate with the Finance team on IT General Controls (ITGCs).

• Report on program advancements to security leadership on a quarterly basis.

• Work closely with Product and Engineering teams to evaluate launches and significant infrastructure modifications.

• Integrate compliance checkpoints into the product discovery process.

• Formulate repeatable processes, runbooks, and AI-powered automation for evidence gathering, testing, scoping, and audit requests.

⛳️ Requirements

• Proven accountability for SOC 2 Type 2 and ISO 27001/27701 programs through multiple audit cycles.

• Experience in defining compliance program roadmaps and KPIs.

• Proficient in developing common control frameworks that span various frameworks, including managing control owners and testing processes.

• Hands-on experience with FedRAMP (Rev5 or 20x).

• Implementation knowledge of NIST 800-53 controls.

• Competence in boundary and System Security Plan (SSP) documentation.

• Experience in third-party evaluations and ongoing monitoring.

• Background in planning and executing risk-based internal audits to test operational effectiveness and adherence to policies.

• Proven ability to drive audit findings towards resolution.

• Experience collaborating with Finance or internal controls teams and external auditors regarding ITGCs and SOX compliance.

• Skilled in partnering with Product and Engineering teams on audit scopes and infrastructure changes.

• Experience in embedding compliance checkpoints throughout product development processes.

• Familiarity with managing recurring governance calendars for policies, access, training, vendor assessments, regulatory compliance, and partner reviews.

• AI-first mindset with experience in creating AI workflows or automations that significantly minimize manual compliance efforts.

• Knowledge of EU financial services obligations or bank-consortium assessments is a plus.

🏝️ Benefits

• Equity

• Medical insurance

• Dental insurance

• Vision insurance

• 401(k)