{"id":1676526,"url":"https://alion.io/job/deepgram-compliance-and-documentation-lead","title":"GRC and Security Compliance Lead","company":{"id":2629,"name":"Deepgram","domain":"deepgram.com","url":"https://alion.io/company/deepgram","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":90,"open_postings":21,"ghost_share":0,"stale_share":0.19,"repost_share":0,"time_to_fill_p50_days":78,"computed_at":"2026-10-13T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":165000,"max":223300,"currency":"USD","period":"year","gross":null,"usd_annual":223300},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Cloudflare","optional":false},{"name":"Deepgram","optional":false},{"name":"Docker","optional":false},{"name":"GDPR","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"Text-to-Speech","optional":false},{"name":"Twilio","optional":false},{"name":"Vapi","optional":false},{"name":"Voice Agents","optional":false},{"name":"AI Agents","optional":true},{"name":"EU AI Act","optional":true},{"name":"FedRAMP","optional":true},{"name":"HIPAA","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"SQL","optional":true}],"status":"live","first_seen_at":"2026-10-01T18:45:33Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-14T01:10:39Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Company Overview\nDeepgram is the leading platform underpinning the emerging trillion-dollar Voice AI economy, providing real-time APIs for speech-to-text (STT), text-to-speech (TTS), and building production-grade voice agents at scale. More than 200,000 developers and 1,300+ organizations build voice offerings that are ‘Powered by Deepgram’, including Twilio, Cloudflare, Sierra, Decagon, Vapi, Daily, Cresta, Granola, and Jack in the Box. Deepgram’s voice-native foundation models are accessed through cloud APIs or as self-hosted and on-premises software, with unmatched accuracy, low latency, and cost efficiency. Backed by a recent Series C led by leading global investors and strategic partners, Deepgram has processed over 50,000 years of audio and transcribed more than 1 trillion words. There is no organization in the world that understands voice better than Deepgram.\nCompany Operating Rhythm\nAt Deepgram, we expect an AI-first mindset-AI use and comfort aren’t optional, they’re core to how we operate, innovate, and measure performance.\nEvery team member who works at Deepgram is expected to actively use and experiment with advanced AI tools, and even build your own into your everyday work. We measure how effectively AI is applied to deliver results, and consistent, creative use of the latest AI capabilities is key to success here. Candidates should be comfortable adopting new models and modes quickly, integrating AI into their workflows, and continuously pushing the boundaries of what these technologies can do.\nAdditionally, we move at the pace of AI. Change is rapid, and you can expect your day-to-day work to evolve just as quickly. This may not be the right role if you’re not excited to experiment, adapt, think on your feet, and learn constantly, or if you’re seeking something highly prescriptive with a traditional 9-to-5.\nThe Opportunity\nDeepgram is looking for a GRC and Security Compliance Lead to own the written and evidentiary backbone of our security and privacy program - the documents and evidence that auditors, enterprise customers, and our own engineers rely on to know what we actually do.\nWe hold SOC 2, ISO 27001, and PCI DSS obligations, we answer a steady stream of enterprise security questionnaires, and we publish public commitments about how we handle data and how our models are built. Today that work is spread across too few people. You will own it: the evidence, the policies, the public posture documents, and the system that keeps all three consistent with each other.\nContext matters here, because the claims you will be writing are unusually specific. Most of our infrastructure is bare metal in colocation datacenters - containerized on Docker, managed with Ansible, and deployed through GitHub Actions - with AWS used for overflow capacity and a small set of services. That means our control environment spans physical and colocation controls, on-premise hosts, and cloud, not a single cloud provider's shared-responsibility model. Deepgram also processes audio - often some of the most sensitive data our customers hold - across several deployment models: hosted with model-improvement opted in, hosted with model-improvement opted out (effectively zero data retention), single-tenant Deepgram Dedicated deployments with regional data residency, and fully self-hosted deployments running in the customer's own environment. Getting a public statement right means understanding which of those a given claim applies to.\nWriting is the core skill in this role, and we mean writing that survives a skeptical reader - an auditor, a Fortune 500 security reviewer, an engineer who knows the system better than you do. Where a claim needs technical verification, you define what has to be proven and partner with Security Engineering to prove it; you are not expected to do that engineering work yourself.\nThis role reports to the Director of Information Security and works closely with Security Engineering, Legal, Research, and Solutions/Sales Engineering.\nWe are open on level. Strong analyst-level and senior candidates are both in scope, and we will calibrate title, scope, and compensation to demonstrated experience.\nResponsibilities\nOwn audit evidence end to end for SOC 2, ISO 27001, and PCI DSS - what evidence is required, who produces it, where it lives, and whether it would actually satisfy a reviewer. Be the auditor's primary point of contact through fieldwork.\n\nOwn control mapping across frameworks. Build and maintain the crosswalk so one control and one piece of evidence satisfies SOC 2, ISO 27001, PCI DSS, and customer questionnaires - rather than running the same work three times.\n\nOwn the colocation and infrastructure vendor side of compliance: datacenter provider SOC reports and attestations, physical security and carve-out language, and how shared responsibility actually divides between us and each provider.\n\nOwn security questionnaires and the security sections of RFPs. Maintain the answer library, keep it current as the product changes, and know which answers to fight for and which to concede.\n\nAuthor and own the lifecycle of our internal policies and standards: drafting, review and approval cycles, annual review, exceptions and carve-outs, and retiring what no longer reflects reality.\n\nOwn our public-facing posture documents - Trust Center content, the AI Safety statement, Model Cards (with Research), the Privacy Policy (with Legal), and the deployment-model and self-hosted documentation customers rely on during review.\n\nOwn the documentation system itself: where documents live, how they are versioned and reviewed, and how a customer-facing claim traces back to an internal source of truth. Nothing we say publicly should be unattributable.\n\nMaintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments - and own the process that keeps them accurate as the product changes.\n\nRun compliance and security awareness training and enablement, including clear guidance to Sales Engineering on what they may and may not commit to on a customer call.\n\nPartner with Security Engineering so evidence is generated once, by automation - from Ansible, GitHub, and our logging and monitoring stack - and reused, and flag where a manual evidence pull should become an automated one.\n\nSupport the privacy program: contribute to DPIAs and transfer impact assessments, subprocessor and vendor privacy reviews, and DSAR intake, in partnership with the Privacy Operations Lead.\n\nSkills Needed\nSubstantial experience in GRC, security compliance, or technical compliance documentation - enough that you have carried at least one audit cycle end to end from the evidence side and owned the outcome.\n\nExceptional writer. This is the central requirement, not a soft skill. You can turn a messy technical reality into a document a skeptical auditor, customer, or engineer will accept.\n\nHands-on involvement in at least one formal audit - SOC 2, ISO 27001, or PCI DSS - as the person producing and defending evidence, not only as a reader of the report.\n\nExperience mapping controls across more than one framework, and a real opinion about how to avoid duplicated compliance work.\n\nTechnically fluent and unintimidated: you can read an architecture diagram, follow a data flow through datacenter and cloud infrastructure, understand what a log line or a retention setting actually implies, and ask the question that exposes a gap - without needing someone to translate for you.\n\nStartup-friendly judgment. You know which questionnaire answers are worth fighting for and which to concede, and when a policy needs a carve-out rather than a mandate. Controls and policies that ignore how the company actually ships get routed around, and we would rather you name the trade-off than write the ideal version.\n\nWorking knowledge of GDPR, CCPA/CPRA, and where AI regulation is heading - enough to write public posture documents that hold up.\n\nBias toward building systems and templates rather than becoming the person every request has to route through.\n\nComfortable with ambiguity and with making a defensible call when the standard is unsettled.\n\nNice to Have\nCertification such as CISA, ISO 27001 Lead Implementer/Auditor, CIPM, CIPT, or CIPP/E.\n\nAudit experience in an on-premise, colocation, or hybrid environment - not only cloud-native.\n\nExperience with compliance automation platforms (Vanta, Drata, or similar) and trust center tooling, including where they fall short outside a pure-cloud environment.\n\nFamiliarity with AI governance frameworks - NIST AI RMF, ISO/IEC 42001, EU AI Act - and with model documentation practice.\n\nExperience with ML/AI data pipelines and training-data governance.\n\nCompliance work in a hybrid model - multi-tenant SaaS alongside self-hosted or on-premise deployments.\n\nComfort with SQL, light scripting, or AI and agentic tooling to pull and assemble your own evidence rather than filing a ticket for it.\n\nExposure to HIPAA or FedRAMP.\n\nNotice: We're aware of individuals impersonating Deepgram recruiters. All legitimate Deepgram recruiting communication comes from an @ deepgram.com email address. If you've received a message claiming to be Deepgram, please forward it to .","description_format":"text","description_chars":9259,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Compliance","Machine Learning","Natural Language Processing"],"lifecycle":[{"event":"open","at":"2026-10-02T08:45:30Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":1,"median_offered_wage_usd":127500,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":11,"expected_fill_days":78,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":223300,"is_top_pay":true},"html_url":"https://alion.io/job/deepgram-compliance-and-documentation-lead","json_url":"https://alion.io/job/deepgram-compliance-and-documentation-lead.json","meta":{"generated_at":"2026-10-14T03:56:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6020,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2629},"rest":"https://alion.io/mcp/rest/get_company?id=2629"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdeepgram-compliance-and-documentation-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdeepgram-compliance-and-documentation-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdeepgram-compliance-and-documentation-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/deepgram-compliance-and-documentation-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdeepgram-compliance-and-documentation-lead"}]}