Security Compliance Lead

Plaid

8d•$141,120 - $259,200

About The Position

Plaid’s Security Governance, Risk, and Compliance (GRC) team proactively manages information security risk and maintains effective controls across the company. The team’s assurance program builds trust with customers, consumers, and data partners by managing certifications, audits, and regulatory obligations as Plaid’s products evolve. The Security Compliance Lead is the single accountable owner of Plaid’s core security compliance program, including SOC 2 Type 2, ISO 27001, ISO 27701, and related governance obligations. The role sets the program’s structure and direction through a roadmap and KPIs, builds a shared control catalog and internal audit program, and ensures compliance is incorporated into product decisions before launch. As Plaid expands into new products, markets, and frameworks, the lead will scale the program using AI and automation without adding headcount.

Requirements

Has been the accountable owner of SOC 2 Type 2 and ISO 27001/27701 programs through multiple audit cycles, including setting roadmaps and KPIs to mature them.
Has built or rebuilt a common control framework mapped across multiple frameworks, with control owners and testing.
Hands-on FedRAMP experience (Rev5 or 20x), including NIST 800-53 control implementation, boundary and SSP documentation, third-party assessment, and continuous monitoring.
Has planned and run risk-based internal audits testing operating effectiveness and policy adherence, and driven findings to remediation.
Has worked with Finance or internal controls teams and external auditors on ITGCs and SOX.
Has partnered with Product and Engineering to scope launches and infrastructure changes into audits and embed compliance checkpoints into product development.
Has run a recurring governance calendar covering policy, access, training, vendor, and regulatory or partner reviews.
Takes an AI-first approach and has built AI workflows or automations that materially reduced manual compliance work, and shares effective practices with the team.

Nice To Haves

Experience with EU financial-services obligations such as DORA, central bank IT and cyber assessments, or FCA operational and security risk reporting.
Experience with bank-consortium assessments such as TruSight.

Responsibilities

Own the core compliance program and governance calendar, leading SOC 2 Type 2, ISO 27001, and ISO 27701 end to end.
Run annual and quarterly governance obligations, including policy reviews, access and change-management reviews, security training, vendor reviews, and regulatory, bank, and partner assessments; assign owners and dates and maintain completion evidence.
Design and maintain a control catalog mapped across every framework Plaid reports against, built to FedRAMP and NIST 800-53 depth, with clear control owners, quarterly owner certification, and testing.
Build a risk-based internal audit plan that tests operating effectiveness and policy adherence; manage the policy lifecycle, track findings through remediation, and partner with Finance on ITGCs.
Define program maturity, establish a roadmap and KPIs, and report progress to security leadership each quarter.
Partner with Product and Engineering to track product roadmaps and supporting infrastructure, assess how launches and material changes affect audit scope and system boundaries, and add lightweight checkpoints to product discovery.
Build repeatable processes, runbooks, and AI-driven automation for evidence, testing, scoping, and audit requests.
Translate customer, bank, regulator, and government-agency obligations into control and audit requirements.