Senior Manager, Compliance & Audit

mpathic

10d•$140,000 - $180,000

About The Position

mpathic is seeking a Senior Manager, Compliance & Audit to own and scale the compliance and audit programs that support its technology, customers, and continued growth. This is a hands-on role for someone who can move comfortably between regulatory requirements, technical systems, external auditors, and internal teams. The role involves leading the audit and certification lifecycle across SOC 1, SOC 2 Type II, ISO/IEC 27001, ISO/IEC 42001, and FDA 21 CFR Part 11, while building a unified compliance program that minimizes duplicate work and integrates compliance into daily operations. The position requires close collaboration with engineering, security, product, delivery, and operations teams to translate requirements into practical controls, automate evidence collection, and ensure systems and processes meet scrutiny from auditors, customers, and regulated-industry partners.

Requirements

7+ years in IT compliance, GRC, audit, or computerized systems validation, including direct ownership of external audits from scoping through final report or certification.
Hands-on experience applying Part 11 and GxP data integrity requirements to software or SaaS systems, including audit trails, electronic signatures, access controls, record retention, and ALCOA+ principles.
Experience writing or leading validation deliverables such as validation plans, requirements traceability, risk-based test evidence (IQ/OQ/PQ or CSA-style), and validation summary reports, as well as supporting customer or sponsor audits of validated systems.
Experience leading or supporting SOC 1 and SOC 2 Type II examinations and ISO/IEC 27001 certification or surveillance audits.
Comfortable reviewing cloud configurations across AWS, GCP, or Azure; IAM policies; CI/CD and change management records; logging; and infrastructure as code well enough to evaluate whether a control is actually operating—not simply whether documentation exists.
Able to plan and execute internal audits, sample and evaluate evidence, write clear findings, and drive corrective and preventive actions (CAPAs) through closure.
Comfortable representing mpathic with external auditors, certification bodies, customers, and sponsor quality teams—and able to challenge findings constructively when the evidence supports a different conclusion.
Able to write policies, findings, and customer responses that engineers can act on and executives can confidently approve.
Understand that strong compliance programs should enable teams to move quickly and responsibly rather than create unnecessary process.

Nice To Haves

Familiarity with FDA Computer Software Assurance (CSA) guidance, GAMP 5, and EU Annex 11 is a strong plus.
Experience with ISO/IEC 42001 or other AI governance frameworks, including NIST AI RMF or the EU AI Act, is a strong plus.
Certifications such as CISA, ISO/IEC 27001 Lead Auditor or Lead Implementer, ISO/IEC 42001 Lead Auditor, ASQ CQA, or CISSP are a plus.

Responsibilities

Plan and run the annual audit and certification cycle for SOC 1, SOC 2, ISO/IEC 27001, ISO/IEC 42001, and Part 11 readiness, including auditor selection, scoping, evidence collection, fieldwork, management responses, and final report or certificate delivery.
Own Part 11 compliance for systems that create, modify, or store regulated records. Maintain the system inventory and GxP impact assessments, lead risk-based validation, and ensure validation documentation remains current through releases and system changes.
Maintain a unified control set mapped across applicable frameworks so evidence can satisfy multiple requirements and teams aren't duplicating work for every audit.
Run a risk-based internal audit program, including ISO-required internal audits and management reviews, and track nonconformities and CAPAs through closure.
Build controls into how mpathic develops and delivers its products and services, including change management, code review, access reviews, release validation, and data handling across customer work. Partner with engineering to automate evidence collection wherever possible.
Monitor control health, identify and escalate gaps early, and drive remediation with control owners across engineering, delivery, operations, HR, and other teams.
Maintain mpathic’s ISO/IEC 42001 AI management system in partnership with ML, engineering, and product teams, including AI risk and impact assessments and documentation of model lifecycle controls.
Own responses to security questionnaires, customer and sponsor quality audits, and compliance-related portions of RFPs and contracts. Maintain and continuously improve our trust center.
Own our GRC platform and its integrations, ensuring control mappings, automated evidence collection, and policy workflows remain accurate and useful.
Maintain the policies and SOPs required by our certifications and regulatory commitments, and deliver compliance training, including Part 11 and GxP training for employees working with regulated systems.
Track changes to FDA guidance, AI governance requirements, and applicable data privacy laws, translating relevant changes into practical recommendations for mpathic’s compliance program.