GRC and Security Compliance Lead

Overview

Own the written and evidentiary backbone of Deepgram's security and privacy program, including the evidence, policies, public posture documents, and the system that keeps them consistent with each other.

What you'll do

• Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS, including what evidence is required, who produces it, where it lives, and whether it would satisfy a reviewer.
• Act as the auditor's primary point of contact through fieldwork.
• Build and maintain a control crosswalk so one control and one piece of evidence satisfies SOC 2, ISO 27001, PCI DSS, and customer questionnaires.
• Own the colocation and infrastructure vendor side of compliance, including datacenter provider SOC reports and attestations, physical security and carve-out language, and how shared responsibility divides between Deepgram and each provider.
• Own security questionnaires and the security sections of RFPs, maintaining the answer library and keeping it current as the product changes.
• Author and own the lifecycle of internal policies and standards, including drafting, review and approval cycles, annual review, exceptions and carve-outs, and retiring outdated policies.
• Own public-facing posture documents, including Trust Center content, the AI Safety statement, Model Cards (with Research), the Privacy Policy (with Legal), and deployment-model and self-hosted documentation.
• Own the documentation system, including where documents live, how they are versioned and reviewed, and how customer-facing claims trace to an internal source of truth.
• Maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments, and own the process that keeps them accurate.
• Run compliance and security awareness training and enablement, including guidance to Sales Engineering on what they may and may not commit to on a customer call.
• Partner with Security Engineering so evidence is generated once by automation from Ansible, GitHub, and the logging and monitoring stack, and flag where manual evidence pulls should become automated.
• Support the privacy program by contributing to DPIAs and transfer impact assessments, subprocessor and vendor privacy reviews, and DSAR intake, in partnership with the Privacy Operations Lead.

What you'll need

• Substantial experience in GRC, security compliance, or technical compliance documentation, including having carried at least one audit cycle end to end from the evidence side and owned the outcome.
• Exceptional writing skills that turn a technical reality into documents a skeptical auditor, customer, or engineer will accept.
• Hands-on involvement in at least one formal audit (SOC 2, ISO 27001, or PCI DSS) as the person producing and defending evidence.
• Experience mapping controls across more than one framework, with a real opinion about avoiding duplicated compliance work.
• Technically fluent: able to read an architecture diagram, follow a data flow through datacenter and cloud infrastructure, and understand what a log line or retention setting implies.
• Startup-friendly judgment about which questionnaire answers to fight for and which to concede, and when a policy needs a carve-out rather than a mandate.
• Working knowledge of GDPR, CCPA/CPRA, and where AI regulation is heading, enough to write public posture documents that hold up.
• Bias toward building systems and templates rather than becoming the person every request routes through.
• Comfortable with ambiguity and with making a defensible call when the standard is unsettled.

Nice to have

• Certification such as CISA, ISO 27001 Lead Implementer/Auditor, CIPM, CIPT, or CIPP/E.
• Audit experience in an on-premise, colocation, or hybrid environment, not only cloud-native.
• Experience with compliance automation platforms (Vanta, Drata, or similar) and trust center tooling, including where they fall short outside a pure-cloud environment.
• Familiarity with AI governance frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) and model documentation practice.
• Experience with ML/AI data pipelines and training-data governance.
• Compliance work in a hybrid model, spanning multi-tenant SaaS alongside self-hosted or on-premise deployments.
• Comfort with SQL, light scripting, or AI and agentic tooling to pull and assemble your own evidence.
• Exposure to HIPAA or FedRAMP.

Details

• Location: USA, remote.
• Reports to the Director of Information Security and works closely with Security Engineering, Legal, Research, and Solutions/Sales Engineering.
• Open on level, with analyst-level and senior candidates both in scope; title, scope, and compensation calibrated to demonstrated experience.
• Expected to actively use and experiment with AI tools as part of an AI-first operating rhythm.