Compliance Manager

Relay • Raleigh, NC

54d • Remote

About The Position

Relay is hiring a Compliance Manager to own their compliance program end-to-end. This role reports to the Sr. Manager of IT & Security and works closely with the SVP of IT & Security. The Compliance Manager will run the active certification portfolio, including SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS. They will serve as the Drata expert, the GRC platform at the center of Relay's compliance efforts. Responsibilities include managing external auditors directly within Drata, maintaining evidence, controls, and audit workflows to ensure certifications are completed on schedule. This is an ownership role responsible for the certification calendar, internal audit program, control library, policy lifecycle, and third-party vendor risk program. Success in this role depends on effective collaboration with department leaders across the organization to make compliance a shared win.

Requirements

• A degree in Computer Science, IT, or a security-related discipline; equivalent compliance certifications (CRISC, CGRC, GRCP, CISM, or CISA) will be considered in place of a formal degree.
• 5+ years of experience in information security compliance, GRC, or audit roles, with at least 2 years directly managing certification programs.
• Hands-on experience running SOC 2 Type II audits end-to-end, including auditor management, evidence collection, and remediation.
• Working knowledge of HIPAA security requirements, ISO 27001:2022 (including ISMS operation and surveillance/recertification audits), and PCI DSS.
• Expert-level proficiency with Drata or a comparable GRC/compliance automation platform (Vanta, Secureframe, Hyperproof), including control mapping, monitoring, and auditor collaboration workflows.
• Demonstrated experience managing external audit firms through complete audit cycles.
• Experience building and running internal audit and control testing programs.
• Experience owning policy management and third-party vendor risk programs.
• Exceptional interpersonal and communication skills: you can translate framework requirements into plain language for any department leader, drive accountability without creating friction, and set a tone that makes compliance a partnership.
• Strong organizational and project management skills — you can run multiple concurrent audit timelines without letting anything slip.

Nice To Haves

• Relevant certifications such as CISA, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP.
• Experience adding new frameworks to an existing program (e.g., HIPAA, NIST, or FedRamp onto an ISO 27001 foundation).
• Experience in a fast-paced, cloud-first SaaS environment serving enterprise customers.
• Familiarity with security tooling that feeds compliance evidence (endpoint protection, identity management, awareness training platforms).
• Experience presenting to management, leadership and steering committees.

Responsibilities

• Own Relay's compliance certification portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — including the master certification schedule, audit readiness, and on-time completion of every engagement.
• Serve as Relay's Drata subject matter expert: administer the platform, maintain control mapping and continuous monitoring, manage evidence collection workflows, and drive adoption across control owners.
• Manage the relationship with our external auditors directly from within Drata — coordinate audit windows, fieldwork, evidence requests, findings, and remediation through to report issuance.
• Run the internal audit program: plan and execute control testing, document results, track findings to remediation, and prepare the organization ahead of every external audit.
• Own control management across all frameworks — maintain the unified control library, assign and support control owners, monitor control health, and remediate gaps and drift.
• Own the policy management lifecycle — draft, review, update, route for approval, publish, and track attestation of security and compliance policies on their required cadence.
• Own third-party vendor risk management: security and compliance reviews for new vendors, periodic reassessments, vendor documentation, and risk tracking through to acceptance or remediation.
• Partner with department leaders across the company to assign compliance responsibilities, communicate requirements in plain language, and hold owners accountable to deadlines with firmness and tact.
• Support customer trust activities, including security questionnaires, customer audit requests, and maintenance of compliance documentation and the trust center.
• Report compliance posture, audit status, risks, and program metrics to security leadership and the Security Steering Committee on a regular cadence.

Benefits

• 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents
• Generous Paid Time Off
• 401(k) Savings Plan + Company Match
• Baby Cash Reward + Paid Parental Leave
• Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling
• Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it.
• Latest tech, standing desks, and all the tools and software you need to thrive

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree