Compliance Program Manager

Superhuman • San Francisco, CA

1d • $133,000 - $182,500 • Hybrid

About The Position

The Compliance Program Manager will run Superhuman’s unified audit program, coordinating quarterly audit activities across SOC 2, the ISO 27000 family, ISO 42001, and other certifications. The role works with audit firms, GRC Partners, and control owners across the company, and plans new audits as Superhuman expands into additional frameworks, platforms, and regions. It also conducts gap assessments to identify the work required for each expansion before decisions are made.

The role builds the audit operating model and runbook and drives automation to streamline evidence collection, reuse evidence across frameworks where possible, simplify requests to control owners, and reduce effort in each audit cycle. Building with AI tools is a normal part of the work, with appropriate human oversight. This is an individual-contributor program management role requiring clear communication, management of competing priorities, and an interest in simplifying complex processes. Superhuman uses a hybrid working model combining focus time with in-person collaboration.

Requirements

• At least 5 years of program management experience running multi-workstream programs, including plans, milestones, dependencies, risk tracking, and leadership reporting.
• At least 5 years running external security audits, including SOC 2 and ISO 27001 at minimum, at a company or audit firm, including audit seasons with several frameworks at once.
• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and PCI-DSS, including where their requirements overlap.
• Experience leading a gap assessment for a new framework or scope change and presenting the results to leadership.
• Experience building or improving audit processes, including calendars, request tracking, runbooks, and roles and responsibilities.
• Technical fluency to understand how evidence is produced in cloud environments, assess the completeness and accuracy of system-generated reports, and identify opportunities for automation using AI tools.
• Clear communication skills and the ability to manage competing priorities and proactively resolve blockers during time-sensitive audit cycles.
• Ability to influence cross-functional stakeholders, establish accountability, and drive deliverables without direct reporting authority.

Nice To Haves

• Experience managing complex external audits in an in-house GRC function, consulting environment, or audit firm.
• Familiarity with additional frameworks such as ISO 42001, PCI DSS, ISO 27701 or 27018, CSA STAR, or international schemes such as IRAP, ISMAP, or C5.
• Experience automating evidence collection or audit reporting, or using LLMs day-to-day to plan, track, and report on program work.
• Experience with a GRC platform or building lightweight internal tooling.

Responsibilities

• Run an integrated audit program and maintain plans and calendars across audits and expansions, tracking milestones, dependencies, risks, and decisions, and providing regular status updates to GRC leadership and stakeholders.
• Plan and run quarterly audits from scoping through reporting and findings closeout, including readiness activities such as control-owner preparation, evidence pre-checks, and walkthrough dry runs.
• Scope audit boundaries with Product and Engineering and identify when launches or new platforms change those boundaries.
• Build and maintain the audit operating model and runbook as the program grows.
• Drive automation of evidence collection, request tracking, and audit reporting; work with GRC Engineering on evidence generation and collection, and reuse evidence and walkthroughs across frameworks where applicable.
• Partner with GRC and Procurement on third-party risk management across the vendor lifecycle.
• Align audit windows across frameworks and firms to minimize duplicate evidence requests to control owners.
• Plan new audits and expansions; evaluate frameworks and scopes and conduct gap assessments, providing recommendations and effort estimates for leadership.
• Work with control owners and GRC Partners to deliver evidence and close findings, and coordinate extended remediation of findings with GRC Partners.
• Manage day-to-day auditor relationships and report audit status, findings, and program metrics to GRC leadership.

Benefits

• Medical, dental, vision, mental health, and fertility benefits.
• Disability and life insurance options.
• 401(k) and RRSP matching.
• Paid parental leave.
• 20 days of paid time off per year, 12 days of paid holidays per year, two floating holidays per year, and flexible sick time.
• Stipends for caregiving, pet care, wellness, home office, and more.
• Annual professional development budget and opportunities.
• Competitive pay.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed