Senior Compliance Engineer

Overview

Own Hevo's GRC program end-to-end, covering audits, risk, vendor management and policy, and act as the technical face of security and compliance to customers and prospects during due diligence.

What you'll do

• Own and operate compliance programs (SOC 2, GDPR, HIPAA, DORA, DPDP as applicable) end-to-end, including control implementation, evidence collection and audit management
• Be the primary point of contact for external auditors and manage audit timelines and evidence collection
• Own the risk assessment program: identify, assess, score, track and report risks via a risk register
• Manage vendor and third-party risk assessments and due diligence
• Respond to customer and prospect security questionnaires (RFPs, due-diligence requests, trust-portal access) with accuracy and speed
• Support Sales and Customer Success on security and compliance calls with prospects and customers, translating technical controls into business language
• Draft, maintain and drive review of security policies and procedures
• Track and report on compliance posture and drift to leadership
• Partner with engineering and security teams to close compliance gaps pragmatically, balancing rigor with velocity
• Use GRC tooling (e.g., Sprinto, Vanta, Drata, or similar) to automate evidence collection and monitoring

What you'll need

• 4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)
• Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end
• Strong understanding of data protection and privacy: GDPR, HIPAA, PII/PHI handling
• Proven ability to manage vendor/third-party risk assessments
• Excellent written and verbal communication, comfortable presenting to and negotiating with external customers, auditors and executives
• Experience responding to customer security questionnaires / RFPs
• Working knowledge of cloud environments (AWS), enough to assess and discuss controls with engineering
• Strong organizational skills, able to manage multiple audits and timelines independently

Nice to have

• Experience with GRC automation platforms (Sprinto, Vanta, Drata, OneTrust)
• Relevant certifications (CISA, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP)
• Experience in a B2B SaaS company handling enterprise customer data