8+ years in security, compliance, or IT with ownership of a security and compliance program at a B2B startup or scale-up.
Led a SOC 2 Type II audit and at least one additional framework (ISO 27001, HIPAA, CJIS, CMMC, ITAR, or FedRAMP).
Experience engaging with enterprise, government, law enforcement, defense, or healthcare customers, collaborating closely with sales on security reviews.
Technical proficiency in scripting (Python or Bash), cloud basics, identity platforms, and device management.
Ability to manage detailed compliance tasks while maintaining a strategic overview.
Skilled in communicating risk to non-technical stakeholders and advocating for necessary changes.
Experience in team leadership or building is a plus, but not mandatory.
Responsibilities
Own compliance programs from start to finish, focusing on SOC 2 Type II and ISO 27001.
Lead the adoption of frameworks like NDAA/TAA, HIPAA, CJIS, CMMC, ITAR, and FedRAMP, determining certification priorities.
Collaborate with sales on customer security reviews and create a trust center for faster deal closures.
Manage data flows and privacy controls for sensitive data, ensuring compliance with GDPR and state regulations.
Automate compliance processes such as onboarding, offboarding, and access reviews, while overseeing identity and device management.
Oversee IT systems and vendor relationships across multiple offices in the US, UK, and India.
Work with engineering on security architecture and incident response, ensuring effective communication with customers during incidents.
Develop a prioritized security roadmap and report progress to leadership, with plans to expand the team as needed.
Benefits
Opportunity to build and lead a security and compliance function from the ground up.
Work directly with engineering leadership and have hands-on involvement in security initiatives.
Engage with a diverse range of clients, including police departments, federal agencies, and Fortune 500 companies.
On-site role in the Bay Area, fostering collaboration and team dynamics.
Full Job Description
The Role:
We're hiring our first Lead Security & Compliance Engineer to own security, IT and compliance at Coram. Our customers range from police departments and federal agencies to Fortune 500 companies, schools and hospitals, across the US, UK and Canada. Every one of them asks how we protect their data. You'll make sure compliance never blocks a deal: you'll own our certifications, lead customer security reviews, and turn policy into real, automated controls across the company. You'll work directly with our engineering leadership and start hands-on. As we grow, you'll have the opportunity to build out the function and the team. This role is based on-site in the Bay Area.
Responsibilities:
Own our compliance programmes end to end, starting with SOC 2 Type II and ISO 27001: controls, evidence, policies, auditors and remediation.
Lead our path to the frameworks customers ask for most, including NDAA / TAA, HIPAA, CJIS, CMMC, ITAR and FedRAMP, and decide which to certify against and which to answer with documentation.
Partner with sales on customer security reviews, questionnaires and due-diligence calls, and build a trust centre and reusable answers so deals move faster.
Own data flows, retention and privacy controls for sensitive video and biometric data, including GDPR, Illinois BIPA and state-by-state retention rules.
Make compliance real: automate onboarding, offboarding and access reviews, and manage identity, SSO, MFA, device management and endpoint protection.
Own IT systems and vendors across our US, UK and India offices.
Work with engineering on security fixes and architecture changes, and lead incident response and customer communication when something goes wrong.
Build a prioritised security roadmap, report progress to leadership, and hire as the function grows.
Qualifications:
8+ years in security, compliance or IT, with ownership of a security and compliance programme at a B2B startup or scale-up.
Personally led a SOC 2 Type II audit, plus at least one more framework such as ISO 27001, HIPAA, CJIS, CMMC, ITAR or FedRAMP.
Experience selling into enterprise, government, law enforcement, defence or healthcare customers, and working closely with sales on security reviews.
Technical enough to work credibly with engineers: scripting (Python or Bash), cloud and infrastructure-as-code basics, identity platforms and device management.
Comfortable doing the detailed work yourself, from questionnaires to policies, while keeping the bigger picture in mind.
Able to explain risk clearly to non-technical people, and to push back on sales or leadership when it matters.
Experience leading or building a team is a plus, but not required.
Nice to have: biometric or video privacy experience, physical security or IoT hardware background, and certifications such as CISSP, CISM, CISA or OSCP.
