Compliance Manager

Relay • Raleigh, NC

55d • Remote

About The Position

Relay is hiring a Compliance Manager to own our compliance program end-to-end. Reporting to the Sr. Manager of IT & Security and working closely with the SVP of IT & Security, you will run our active certification portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — and serve as our Drata expert, the GRC platform at the center of everything we do. You'll manage our external auditors directly from within Drata, keeping evidence, controls, and audit workflows moving so certifications land on schedule, every time.
This is an ownership role, not a coordination role. The certification calendar, internal audit program, control library, policy lifecycle, and third-party vendor risk program will all be yours. And because compliance at Relay is a company-wide effort, your success depends on how well you work with department leaders across the entire organization — earning their trust, making their obligations clear and achievable, and holding the line on deadlines and requirements with professionalism and tact. If you can make compliance feel like a shared win rather than a burden, this role is built for you.

Requirements

• A degree in Computer Science, IT, or a security-related discipline; equivalent compliance certifications (CRISC, CGRC, GRCP, CISM, or CISA) will be considered in place of a formal degree.
• 5+ years of experience in information security compliance, GRC, or audit roles, with at least 2 years directly managing certification programs.
• Hands-on experience running SOC 2 Type II audits end-to-end, including auditor management, evidence collection, and remediation.
• Working knowledge of HIPAA security requirements, ISO 27001:2022 (including ISMS operation and surveillance/recertification audits), and PCI DSS.
• Expert-level proficiency with Drata or a comparable GRC/compliance automation platform (Vanta, Secureframe, Hyperproof), including control mapping, monitoring, and auditor collaboration workflows.
• Demonstrated experience managing external audit firms through complete audit cycles.
• Experience building and running internal audit and control testing programs.
• Experience owning policy management and third-party vendor risk programs.
• Exceptional interpersonal and communication skills: you can translate framework requirements into plain language for any department leader, drive accountability without creating friction, and set a tone that makes compliance a partnership.
• Strong organizational and project management skills — you can run multiple concurrent audit timelines without letting anything slip.

Nice To Haves

• Relevant certifications such as CISA, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP.
• Experience adding new frameworks to an existing program (e.g., HIPAA, NIST, or FedRamp onto an ISO 27001 foundation).
• Experience in a fast-paced, cloud-first SaaS environment serving enterprise customers.
• Familiarity with security tooling that feeds compliance evidence (endpoint protection, identity management, awareness training platforms).
• Experience presenting to management, leadership and steering committees.

Responsibilities

• Own Relay's compliance certification portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — including the master certification schedule, audit readiness, and on-time completion of every engagement.
• Serve as Relay's Drata subject matter expert: administer the platform, maintain control mapping and continuous monitoring, manage evidence collection workflows, and drive adoption across control owners.
• Manage the relationship with our external auditors directly from within Drata — coordinate audit windows, fieldwork, evidence requests, findings, and remediation through to report issuance.
• Run the internal audit program: plan and execute control testing, document results, track findings to remediation, and prepare the organization ahead of every external audit.
• Own control management across all frameworks — maintain the unified control library, assign and support control owners, monitor control health, and remediate gaps and drift.
• Own the policy management lifecycle — draft, review, update, route for approval, publish, and track attestation of security and compliance policies on their required cadence.
• Own third-party vendor risk management: security and compliance reviews for new vendors, periodic reassessments, vendor documentation, and risk tracking through to acceptance or remediation.
• Partner with department leaders across the company to assign compliance responsibilities, communicate requirements in plain language, and hold owners accountable to deadlines with firmness and tact.
• Support customer trust activities, including security questionnaires, customer audit requests, and maintenance of compliance documentation and the trust center.
• Report compliance posture, audit status, risks, and program metrics to security leadership and the Security Steering Committee on a regular cadence.

Benefits

• 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents
• Generous Paid Time Off
• 401(k) Savings Plan + Company Match
• Baby Cash Reward + Paid Parental Leave
• Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling
• Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it.
• Latest tech, standing desks, and all the tools and software you need to thrive

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level