Compliance and Documentation Lead

Deepgram • ,

7d • $165,000 - $223,300

About The Position

Deepgram is seeking a Compliance and Documentation Lead to manage the written and evidentiary aspects of its compliance program, encompassing both privacy and security. This role will be responsible for the operational work of the privacy program, including assessments, data flow mapping, and managing data subject requests. Additionally, the lead will oversee security compliance obligations under SOC 2, ISO 27001, and PCI DSS, as well as manage security questionnaires, policies, and public-facing documents. The position emphasizes leveraging the interconnectedness of privacy and security data to establish and maintain compliance documentation efficiently. The role requires a deep understanding of Deepgram's various deployment models (hosted with/without model improvement, dedicated single-tenant, and self-hosted) to ensure accuracy in compliance claims. The core skill is exceptional writing, capable of translating complex technical realities into clear, defensible documentation for auditors, enterprise customers, and internal engineers. While not expected to perform engineering tasks, the lead will collaborate with Security Engineering to verify technical claims. This is a senior individual contributor role reporting to the Director of Information Security, with close collaboration with Security Engineering, Legal, Research, and Solutions/Sales Engineering. Deepgram is an AI-first company that moves at the pace of AI, expecting team members to actively use and experiment with AI tools.

Requirements

• Substantial experience in privacy operations, GRC, security compliance, or technical compliance documentation — enough that you have carried assessments or an audit cycle end to end and owned the outcome.
• Exceptional writer. This is the central requirement, not a soft skill. You can turn a messy technical reality into a document a skeptical auditor, customer, or engineer will accept.
• Demonstrated ownership of compliance operational systems at scale: data maps, DSAR workflows, evidence collection, answer libraries, policy sets, or the tooling behind them.
• Hands-on involvement in at least one formal audit — SOC 2, ISO 27001, or PCI DSS — as the person producing and defending evidence, not only as a reader of the report.
• Practical, applied experience with GDPR and CCPA/CPRA, and a current view of where AI regulation is heading.
• Technically fluent and unintimidated: you can read an architecture diagram, follow a data flow through cloud infrastructure, understand what a log line or a retention setting actually implies, and ask the question that exposes a gap — without needing someone to translate for you.
• Able to hold your own with a Fortune 500 privacy team, security reviewer, or DPO without escalating every question.
• Startup-friendly judgment. You know which questionnaire answers are worth fighting for and which to concede, and when a policy needs a carve-out rather than a mandate. Controls and policies that ignore how the company actually ships get routed around, and we would rather you name the trade-off than write the ideal version.
• Bias toward building systems and templates rather than becoming the person every request has to route through.
• Comfortable with ambiguity and with making a defensible call when the law or the standard is unsettled.

Nice To Haves

• Certification such as CIPM, CIPT, CIPP/E, CISA, or ISO 27001 Lead Implementer/Auditor.
• Experience with compliance automation platforms (Vanta, Drata, or similar) and trust center tooling.
• Familiarity with AI governance frameworks — NIST AI RMF, ISO/IEC 42001, EU AI Act — and with model documentation practice.
• Experience with ML/AI data pipelines and training-data governance.
• Compliance work in a hybrid model — multi-tenant SaaS alongside self-hosted or on-premise deployments.
• Comfort with SQL, light scripting, or AI and agentic tooling to pull and assemble your own evidence rather than filing a ticket for it.
• Exposure to HIPAA or FedRAMP.

Responsibilities

• Own customer and prospect privacy risk assessments, DPIAs, and transfer impact assessments end to end.
• Be the technical voice in customer privacy reviews and vendor due diligence calls.
• Build and maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments — and own the process that keeps them accurate as the product changes.
• Own the operating model for our privacy controls: retention and deletion enforcement, DSAR and deletion workflows, consent and opt-out handling, de-identification and redaction. You specify, instrument, test, and audit; Engineering builds.
• Own the subprocessor and vendor privacy review process, and the artifacts behind our DPAs.
• Translate GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws, and emerging AI regulation (EU AI Act, state AI and automated decision-making rules) into concrete requirements engineering and GTM teams can act on, rather than memos.
• Partner with Legal on DPAs, SCCs, transfer mechanisms, and the residency commitments we make for dedicated deployments.
• Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS — what evidence is required, who produces it, where it lives, and whether it would actually satisfy a reviewer.
• Be the auditor's primary point of contact through fieldwork.
• Own control mapping across frameworks. Build and maintain the crosswalk so one control and one piece of evidence satisfies SOC 2, ISO 27001, PCI DSS, privacy obligations, and customer questionnaires — rather than running the same work four times.
• Own security questionnaires and the security sections of RFPs. Maintain the answer library, keep it current as the product changes, and know which answers to fight for and which to concede.
• Partner with Security Engineering so evidence is generated once, by automation, and reused — and flag where a manual evidence pull should become an automated one.
• Author and own the lifecycle of our internal policies and standards: drafting, review and approval cycles, annual review, exceptions and carve-outs, and retiring what no longer reflects reality.
• Own our public-facing posture documents — Trust Center content, the AI Safety statement, Model Cards (with Research), the Privacy Policy (with Legal), and the deployment-model and self-hosted documentation customers rely on during review.
• Own the documentation system itself: where documents live, how they are versioned and reviewed, and how a customer-facing claim traces back to an internal source of truth. Nothing we say publicly should be unattributable.
• Design and run operational auditing and remediation workflows, so drift between what we claim and what we do is caught by process rather than by a customer.
• Run compliance and privacy training and enablement, including clear guidance to Sales Engineering on what they may and may not commit to on a customer call.

Benefits

• AI-first mindset expectation
• Opportunity to work at the pace of AI
• Senior individual-contributor role
• Calibrated title, scope, and compensation to demonstrated experience

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed