Compliance Manager [IC3]

Sourcegraph is seeking a Compliance Manager (IC3) to own and drive its governance, risk, and compliance program, with a primary focus on compliance. The role is highly cross-functional, working with Security, Engineering, IT, Legal, People, Sales, and other teams. The position is remote, with a preference for residents of the USA.

Responsibilities

Own and drive the governance, risk, and compliance program with a primary focus on compliance; Maintain and evolve the compliance program, including owning SOC 2 and ISO 27001 certifications and preparing for additional frameworks; Design and tailor controls, collect evidence, train internal teams, work with auditors, manage remediation, and drive follow-up work through completion; Independently manage key audit activities, including control testing, evidence collection, stakeholder coordination, auditor requests, findings, and remediation; Evaluate existing controls and tailor them to the company's environment; Maintain the risk register, ISMS processes, policies, and compliance documentation; Provide practical compliance guidance to internal teams; Support customer-facing compliance activities, including security questionnaires; Own the operating rhythm of the GRC program, including ISMS meetings, risk management, control reviews, and audit preparation; Establish a forward-looking compliance roadmap; Identify control gaps, assess risk, recommend solutions, and drive remediation; Introduce automation, AI, or process improvements that reduce manual compliance work

Requirements

5+ years of experience in governance, risk, compliance, information security compliance, or a related role; Demonstrated end-to-end ownership of SOC 2 and ISO 27001 programs, ideally within a SaaS, technology startup, or similarly fast-moving environment; Experience personally managing external audits and certification processes, including audit preparation, evidence collection, control testing, stakeholder training, auditor interaction, remediation, and follow-up; Strong understanding of risk management, control design, ISMS governance, and compliance program operations; Experience adapting compliance controls to an organization's actual environment rather than applying generic or overly prescriptive requirements; Familiarity with cloud-based technology environments and the security and compliance considerations associated with a distributed or remote workforce; Strong project management and organizational skills with the ability to drive cross-functional initiatives from inception through completion; Excellent written and verbal communication skills and the ability to explain compliance requirements clearly to both technical and non-technical audiences; A hands-on mindset and willingness to personally execute the work required to keep the compliance program operating effectively; Curiosity about AI, automation, and emerging technology, with an interest in using new tools to improve compliance workflows; Working hours must overlap with GMT-3 for at least 20 hours/week

Nice to have

Experience with additional security, privacy, or compliance frameworks such as GDPR, HIPAA, HITRUST, FedRAMP, FISMA, PCI DSS, or related standards; Experience supporting security questionnaires, customer assurance processes, or sales-related compliance activities; Experience with GRC platforms, compliance automation tools, or building internal automation for evidence collection and control monitoring; Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CRISC, or similar credentials

Benefits

Above-market salaries; Meaningful equity; Generous perks and benefits