Compliance Lead (part-time, contractor)

Soda Data • New York, NY

7d • Remote

About The Position

Soda is seeking a part-time contractor to own and continue building its compliance function. The company has operated a SOC 2 cycle since 2021 and has recently worked to automate and professionalize its compliance processes. The role will further automate and streamline compliance, reduce manual execution and evidence-gathering demands on engineering and operations, and adapt controls pragmatically as Soda’s product and operations evolve, including its use of AI.

Approximately half the role focuses on improving the compliance program’s structure: extending automation, adapting compliance processes and controls to new developments, and making responses to RFPs and security questionnaires more efficient and current. The other half focuses on running the program and maintaining audit readiness, including the annual SOC 2 Type II and SOC 3 cycle, control monitoring, people compliance, and support for Sales during enterprise security reviews.

This is a remote, part-time role for a self-directed contractor working in an EU time zone, with roughly two to three days of availability per week and solid working-hours overlap with CET. The role calls for someone who can run a SOC 2 program pragmatically, engage busy engineers with minimal friction, and build scripts, integrations, prompts, and AI-assisted workflows that can withstand auditor scrutiny.

Requirements

• At least 3 years of experience in security compliance or GRC, ideally at a B2B SaaS company.
• Hands-on experience running a SOC 2 Type II cycle, including working directly with an external auditor on scoping, sampling, and remediation.
• Hands-on experience with a compliance automation platform; Drata is preferred, or experience with Vanta or Secureframe.
• Ability to design and implement automations, including AI-assisted workflows.
• Familiarity with AWS, Okta, GitHub, and endpoint-management systems sufficient to assess the validity of evidence.
• Experience answering enterprise security questionnaires and participating confidently in live customer security reviews.
• Clear written and spoken English, and sound judgment in writing practical policies.
• Availability roughly 2–3 days per week, with solid working-hours overlap with CET.
• Must work in an EU time zone.
• Must be able to invoice as a freelancer or contractor.
• Able to work self-directed and predictably, manage one’s own agenda, and flag early when decisions are needed.
• Able to manage timely control execution and evidence from busy engineers while minimizing friction.
• Comfortable being the sole compliance specialist and designing pragmatic controls appropriate to the company’s size.

Nice To Haves

• Experience working at a company with fewer than 200 people, where compliance is handled by one person with substantial automation.
• ISO 27001 experience.
• A certification such as CISA, CISM, CIPP/E, or ISO 27001 Lead Implementer.

Responsibilities

• Further automate Soda’s compliance program using its existing compliance automation platform and other suitable tools.
• Develop pragmatic compliance processes and controls that keep pace with Soda’s product, operations, and use of AI while maintaining its commitments.
• Improve and streamline responses to RFPs and security questionnaires, expanding existing tooling and keeping references up to date.
• Own the annual SOC 2 Type II and SOC 3 cycle with the external auditor, including planning, access, samples, Soda’s portion of the report, and closing findings.
• Maintain an audit-ready control set throughout the year by monitoring expiring or failing controls and following up on outstanding items.
• Run people-compliance processes for onboarding and offboarding, annual security training, code of conduct, incident reporting, and phishing cycles.
• Partner with Sales on enterprise security reviews and help unblock deals without making commitments Soda does not fulfill.
• Design and implement automations, integrations, prompts, scripts, and AI-assisted workflows for compliance.

Benefits

• A mandate to build a modern, forward-looking compliance system that keeps pace with and leverages opportunities created by AI.
• A live, certified program relied upon by enterprise customers, with freedom to implement improvements.
• Documented starting materials, including runbooks for manual controls, a scheduling system for upcoming work, and a written handover from the predecessor.
• An AI-forward company that will fund and use the work built in the role.
• Direct access to decision-makers.
• A competitive contractor rate.

What This Job Offers

• Job Type: Part-time
• Career Level: Senior
• Education Level: No Education Listed