Compliance Program Manager

Finix•San Francisco, CA

2d•$120,000 - $150,000

About The Position

The Compliance Program Manager will own Finix’s compliance program end to end, from audit planning and control design through evidence collection and remediation. The role sits within the Information Security organization, which protects Finix’s platform, customers, and data, and works closely with Engineering, Information Security, Legal, and IT. The manager will lead Finix’s PCI DSS program as a Level 1 service provider and its SOC 2 Type II program; manage relationships with QSAs and external auditors; coordinate audit fieldwork; and partner with control owners on evidence, testing, and remediation. The role also maintains policies, procedures, and a control framework mapped across applicable requirements; conducts risk assessments and vendor reviews; responds to customer and partner compliance requests; reports program status and risks to leadership; and improves compliance processes as Finix expands into new products and markets.

Requirements

At least 5 years of experience in compliance, audit, or GRC in payments or fintech.
PCI DSS experience as a service provider, including ROC assessments with a QSA.
Hands-on SOC 2 experience, including owning or supporting Type II audits.
Experience working with external auditors, or experience working as an external auditor or QSA.
Clear written and verbal communication, including presenting audit results and risks to technical and non-technical audiences.
Experience with GRC platforms such as Drata or Vanta.
General technical background and comfort discussing systems, infrastructure, and security controls with engineers.

Nice To Haves

Working knowledge of cloud infrastructure, especially AWS.
Internal audit experience.
Certifications such as CISA, PCI ISA, PCI QSA, or CISSP.

Responsibilities

Own the PCI DSS program as a Level 1 service provider, including scoping, the annual ROC and AOC, and ongoing compliance between assessments.
Own the SOC 2 Type II program, including audit planning, control design, and the annual report.
Manage relationships with QSAs and external auditors, and lead audit fieldwork from kickoff through final report.
Partner with control owners across teams to collect evidence, test controls, and drive remediation of findings.
Maintain policies, procedures, and the control framework mapped across PCI DSS, SOC 2, and other regulatory requirements.
Run risk assessments, third-party vendor risk reviews, and BCP/DR activities.
Respond to customer security questionnaires, partner due diligence requests, and compliance attestation requests.
Track compliance metrics and report program status and risks to leadership.
Build and improve compliance processes as Finix scales into new products and markets.