{"id":3350393,"url":"https://alion.io/job/socket-compliance-engineering-lead-2","title":"Compliance Engineering Lead","company":{"id":1775144,"name":"Socket","domain":"socket.io","url":"https://alion.io/company/socket-io","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Legal","role_family":"Legal","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"EU AI Act","optional":false},{"name":"GCP","optional":false},{"name":"GitHub","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"SOC 2","optional":false},{"name":"Anthropic","optional":true},{"name":"Figma","optional":true},{"name":"Vercel","optional":true}],"status":"live","first_seen_at":"2026-10-27T13:31:47Z","employer_posted_date":null,"last_verified_at":"2026-10-27T13:31:47Z","board_verified":false,"closed_at":null,"days_open":1,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":1},"description":"About Us\n\nSocket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers - from Anthropic to xAI, and Figma to Vercel - love Socket (just check out their tweets to see for yourself!)\n\nFounded by Feross Aboukhadijeh, a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised $125M in funding from top angels, operators, and security leaders.\n\nAbout the Role\nWe are hiring a Compliance Engineering Lead to own compliance as an engineered system rather than a calendar of reminders.\n\nSocket sells to security teams. Our customers ask harder questions than most buyers ask, and they are right to. That means our SOC 2 Type II, our path to ISO 27001, our risk and vendor programs, and the assurance artifacts we put in front of enterprise buyers all have to be genuinely well run, not merely present. The credibility of what we sell depends on it.\n\nThis is a foundational role, and it is deliberately an engineering role. The person we want does not manage compliance by chasing people for screenshots. They write code against APIs, build control tests that run on a schedule and fail loudly, and treat evidence collection as a pipeline with an owner and an SLA. You will own the compliance platform decision, including whether the platform we use today is the right one. If your answer is that we should build more of it ourselves, make that case.\n\nYou will report directly to the CISO, own the compliance program end to end, and hire and lead your first teammate, a customer trust hire focused on security questionnaires, RFPs, and contract security review with Legal. You will shape what GRC at Socket becomes.\n\nWhat You'll Do\n\nOwn SOC 2 Type II end to end. Run the observation window, the auditor relationship, and the evidence pipeline behind both. Scope the audit and make sure the controls we describe are the controls that actually run. You own the report our customers read.\n\nTake Socket through ISO 27001 certification. Define the scope and the ISMS, run the gap assessment and internal audit, prepare the organization and get us certified. Enterprise customers are asking for this now. Then keep the ISMS alive as something the company uses rather than something the auditor visits.\n\nMake evidence collection continuous, automated, and boring. Write and maintain automation that pulls evidence directly from the systems of record: GCP, GitHub, our identity provider, MDM, ticketing. Build control monitoring that alerts on drift the day it happens instead of surfacing it the week before an audit. Every recurring manual task you inherit is a candidate for deletion.\n\nTurn risk management and vendor risk into working programs. Maintain a risk register that reflects the risks we actually carry and that leadership uses when making decisions. In partnership with our external security partner, run third party risk with real tiering, real reviews, and a renewal cadence that holds.\n\nOwn the customer-facing assurance surface. Launch and maintain our trust portal, and build the library of artifacts that answers enterprise buyers before they send a spreadsheet. Measure your success by how much questionnaire load disappears, not by how quickly it gets processed.\n\nScope our AI assurance posture. Our customers are shipping AI systems and so are we. Evaluate what matters: ISO/IEC 42001, emerging AI agent assurance standards such as AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework. Inform which of these to commit to, in what order, and what it would take. This is open ground and you will help decide what Socket does here.\n\nWhat You'll Bring\n\nYou have personally owned at least two full SOC 2 Type II cycles as the accountable person. Not contributed to them. Owned them, including the auditor relationship, the scoping arguments, the evidence, and the findings. You can describe a control that failed, why, and what you changed so it stopped failing.\n\nISO 27001 depth. You have taken an organization through certification or run an ISMS through surveillance audits, and you know the difference between an ISMS that works and a binder that satisfies an auditor.\n\nYou build automations. Comfortable building and maintaining automations against services. You can operate with GCP, GitHub, Iru and other reaching for a scheduled job before a recurring calendar reminder. You do not need to be a software engineer by training. You do need to be someone who automates.\n\nClear opinions about compliance platforms. Hands-on experience with Drata, Vanta, or similar, and specific views on where these tools create leverage and where they create the appearance of control.\n\nThe judgment to prioritize. You can tell the difference between a control gap that represents real risk and one that represents an auditor's formatting preference, and you spend the company's time accordingly.\n\nWriting that holds up in front of four audiences. Auditors, enterprise security reviewers, engineers, and executives.\n\nThe instinct to step toward unowned problems, including the unglamorous seams between Security, Engineering, Legal, and Go-to-Market. Compliance at a company our size lives in those seams.\n\nExperience in a remote, fast-moving environment where priorities shift and nobody hands you a fully defined program.\n\nNice to Have: \n\nExposure to AI governance frameworks (ISO/IEC 42001, NIST AI RMF, EU AI Act); experience at a security vendor or another company held to a higher bar by its own customers; contract security review alongside Legal; having built compliance automation in-house rather than buying it.\n\nOur Interview Process\n\nInformational with a member of our Talent Team\n\nHiring Manager interview with our CISO\n\nWorking session: walk us through a control you automated, and design an evidence pipeline with us\n\nCross-functional interviews with Engineering and Go-to-Market\n\nDebrief\n\nDecision and offer\n\nHiring is a big decision on both sides. Read more about our Hiring Philosophy and how we approach the process at Socket.\n\nBenefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer:\n\nMarket competitive salary bands\n\nMeaningful equity program\n\nComprehensive health benefits for you and your family (99% coverage)\n\nFlexible time-off, holidays, and winter shutdown to rest & recharge\n\nPaid parental leave\n\nRemote-first, with quarterly team off-sites \n\nAt Socket, we\n\nPursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction.\n\nMove with urgency and focus: We prioritize swift, decisive action.\n\nThink rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions.\n\nTrust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve.\n\nFeel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we're non-territorial regarding our nominal domains.\n\nAre customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction.","description_format":"text","description_chars":7354,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-27T18:24:15Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":28,"reasons":["seen:1","velocity","win:early"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/socket-compliance-engineering-lead-2","json_url":"https://alion.io/job/socket-compliance-engineering-lead-2.json","meta":{"generated_at":"2026-10-29T12:37:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18981,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1775144},"rest":"https://alion.io/mcp/rest/get_company?id=1775144"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsocket-compliance-engineering-lead-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsocket-compliance-engineering-lead-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsocket-compliance-engineering-lead-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/socket-compliance-engineering-lead-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsocket-compliance-engineering-lead-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3350393}},{"tool":"search_jobs","arguments":{"company":"socket.io","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3350393},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}