Director, Security Compliance and Trust

Motive

2d•$225,000 - $305,000

About The Position

As Director, Security Compliance and Trust, you will build and lead the function that earns and sustains customer, regulator, and partner confidence in Motive. Reporting to the CISO, you will own governance, risk and compliance; audit and certification across ISO 27001/27701, SOC 1 and SOC 2, PCI DSS and the path to FedRAMP; privacy and data protection; customer trust; security policy; training and human risk; and AI governance. You will partner closely with Legal, Engineering, Product, IT, Finance, Sales and Customer Success to make compliance a business enabler rather than a tax. This is a hands-on leadership role. You will lead a small, senior, globally distributed team — and you will also write policy, design controls, sit in audit fieldwork, and answer the hardest customer questions yourself. We expect this function to be built AI-first, with automation designed into the operating model from day one rather than added to a traditional GRC team later. Global expansion is central to the role: Motive is growing into Canada, the EU, Mexico and South America, and you will be the person who makes those markets enterable — mapping obligations before Sales arrives and building controls that satisfy multiple jurisdictions at once.

Requirements

8+ years in security compliance, GRC, privacy, audit or risk management, including 5+ years in leadership roles managing both people managers and senior individual contributors
Demonstrably hands-on. You have personally written the policies, designed the controls, built the control mappings, sat through fieldwork and answered the hardest customer questions yourself — recently, not a decade ago. Be prepared to walk through work you did with your own hands
Proven ownership of multi-framework compliance programs at scale in a cloud-native SaaS environment — ISO 27001, SOC 1 and SOC 2, and PCI DSS as core, with the judgment to run them as one program rather than three
Deep, operational privacy experience across GDPR and CCPA/CPRA, with hands-on ownership of DSAR operations, DPIAs, ROPA and cross-border transfer mechanics. CIPP/E, CIPP/US or CIPM is a plus, but demonstrated operational ownership matters more
Experience standing up compliance and privacy in new international markets, ideally including Canada, the EU, Mexico or Latin America. Familiarity with PIPEDA/Law 25, LGPD or the Mexican LFPDPPP is a strong advantage
Experience with FedRAMP, ideally having led an organization through authorization or Moderate/High readiness, with the appetite to build Motive's path from the ground up
Concrete, demonstrated use of AI to run compliance work — evidence collection, questionnaire response, control monitoring, policy drafting, audit preparation or regulatory gap analysis. We will ask what you built, what it replaced, and what it measurably changed. General enthusiasm for AI is not what we're looking for
Demonstrated ownership of customer-facing trust functions — security reviews, questionnaires, trust portals and enterprise escalation — and experience leading globally distributed teams across multiple timezones
Working fluency in AI governance frameworks and a clear point of view on governing AI without blocking its adoption

Nice To Haves

Experience supporting IPO readiness, SOX or equivalent regulated-environment scrutiny, and experience with sensitive personal data at scale, are both strongly preferred

Responsibilities

Own the compliance, privacy and trust function end-to-end — org design, hiring, and global team development — and act as Motive's senior authority on the control environment, deciding which frameworks we adopt and where we accept versus remediate risk
Build a single integrated control framework that maps once to many across ISO 27001/27701, SOC 1 and SOC 2, PCI DSS, FedRAMP, GDPR and CCPA/CPRA, so evidence is collected once rather than once per framework or once per country
Own the annual audit calendar end-to-end, manage auditor and assessor relationships directly, and lead Motive's path to FedRAMP from the ground up as public sector opportunity matures
Own privacy compliance operations — data subject rights, DPIAs, ROPA and cross-border transfer mechanics — treating driver data as the sensitive category it is, including location history, in-cab video, telematics behavior and biometric-adjacent processing
Own regulatory readiness for new markets ahead of go-to-market, partnering with Engineering and Platform on data residency and regional architecture rather than solving localization with policy language
Be the face of Motive's security and privacy posture to customers — owning trust.gomotive.com, scaling security questionnaire and review response, and serving as the senior escalation point in enterprise deals
Architect the AI-first operating model for the function, personally building and iterating on evidence automation, continuous control monitoring and AI-assisted questionnaire response rather than delegating it to a tooling vendor
Own the security policy and standards library and its exceptions process, along with company-wide security training, phishing simulation and human risk measurement
Establish Motive's AI governance program across both product and internal AI use, building against ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act