Compliance Manager

Procare Solutions•Denver, CO

12d•Hybrid

About The Position

We're looking for a Compliance Manager to own and mature our compliance program as we scale. You'll be the primary driver of our SOC 2 Type 2 audit program for 5 products, and will provide critical support across SOX, privacy, PCI, HIPAA, and additional regulatory and professional framework compliance efforts. This is a hands-on role for someone who enjoys building repeatable processes, working cross-functionally with engineering and IT teams, and translating regulatory and contractual requirements into practical, auditable controls for business units. You'll lead a small team: analysts, contractors, stakeholders - making this a great opportunity for someone ready to take on people leadership while staying close to the technical and operational details of compliance work.

Requirements

4+ years' of experience in compliance, information security, or IT audit, with direct experience running or supporting SOC 2 Type 2 audits.
Working knowledge of SOX ITGC concepts, privacy frameworks (GDPR/CCPA), and PCI DSS requirements.
Experience reviewing contract terms.
Familiarity with common control frameworks (e.g., HIPAA, AICPA Trust Services Criteria, NIST CSF, ISO 27001).
Prior experience managing or mentoring junior team members or contractors.
Strong written and verbal communication skills — you can explain control requirements to engineers and translate technical detail for auditors and leadership.
Comfortable working in a fast-paced SaaS environment with evolving systems and processes.
Bachelor's degree in a related field, or equivalent practical experience.
Experience supporting multiple concurrent audit cycles in a SaaS or cloud environment.
Experience with cloud infrastructure (AWS, GCP, or Azure) and understanding of how technical controls map to compliance requirements.

Nice To Haves

Experience working with GRC platforms (e.g., Vanta, Drata, OneTrust, ServiceNow GRC) is a strong plus.
Relevant certifications: CISA, CISM, CIPP/E, CIPP/US, or similar.

Responsibilities

Own the end-to-end audit lifecycle — scoping, control design, evidence collection, auditor liaison, remediation tracking, and continuous monitoring between audit cycles for SOC 2 Type 2.
Assist with IT general controls (ITGCs) testing, walkthroughs, and coordination with internal audit and external auditors to support financial reporting compliance for SOX.
Support privacy compliance efforts (e.g., GDPR, CCPA/CPRA) including audit prep, control validation, and documentation of data handling practices.
Support PCI DSS assessments, including scoping, control validation, and coordination with payment processing and engineering teams.
Review, negotiate and track DPAs with customers, vendors, and subprocessors, ensuring alignment with our data protection commitments and privacy obligations.
Assess subprocessors and vendors for compliance posture and contractual data protection requirements.
Partner with Engineering, IT, and Security teams to design, implement, and monitor controls; maintain a strong evidence trail and control library.
Maintain and evolve compliance policies, procedures, and control narratives to reflect the current environment and audit requirements, including ensuring NEO and annual training is released and accurate.
Serve as a key point of contact for external auditors, customer security questionnaires, and due diligence requests.
Identify opportunities to automate evidence collection and streamline control monitoring using GRC tooling.