plaid - Security Compliance Lead
Requirements
• Compliance program ownership: • Has been the accountable owner of SOC 2 Type 2 and ISO 27001/27701 programs through multiple audit cycles, including setting the roadmap and KPIs that matured them • Has built or rebuilt a common control framework mapped across multiple frameworks, with control owners and testing • Hands-on FedRAMP experience (Rev5 or 20x): NIST 800-53 control implementation, boundary and SSP documentation, third-party assessment, and continuous monitoring • Internal audit, policy assurance, ITGC, and SOX: • Has planned and run risk-based internal audits that test operating effectiveness and policy adherence, and has driven findings to remediation • Has worked with Finance or internal controls teams and external auditors on ITGCs and SOX • Governance obligations and product-aware compliance: • Has partnered with Product and Engineering to scope launches and infrastructure changes into audits, and has embedded compliance checkpoints into product development • Has run a recurring governance calendar (policy, access, training, vendor, and regulatory or partner reviews) and translated obligations from customers, banks, regulators, or government agencies into control and audit requirements • AI fluency and tooling: • Takes an AI-first approach: has built AI workflows or automations that materially reduced manual compliance work, and shares what works with the team • Experience with EU financial-services obligations (DORA, central bank IT and cyber assessments, FCA operational and security risk reporting) or bank-consortium assessments such as TruSight • Our mission at Plaid is to unlock financial freedom for everyone. To support that mission, we seek to build a diverse team of driven individuals who care deeply about making the financial ecosystem more equitable. We recognize that strong qualifications can come from both prior work experiences and lived experiences. We encourage you to apply to a role even if your experience doesn't fully match the job description. We are always looking for team members that will bring something unique to Plaid!
Responsibilities
• Own the compliance program and governance calendar: Lead SOC 2 Type 2, ISO 27001, and ISO 27701 end to end. Run the annual and quarterly governance obligations (policy reviews, access and change-management reviews, security training, vendor reviews, and regulatory, bank, and partner assessments), each with an owner, a date, and evidence of completion. • Build and own the control catalog: Design and maintain one control catalog mapped across every framework Plaid reports against, built to FedRAMP and NIST 800-53 depth, with clear control owners, quarterly owner certification, and testing. • Run internal audit and policy assurance: Build a risk-based internal audit plan that tests operating effectiveness and whether policies are followed, and own the policy lifecycle. Track findings to remediation, and partner with Finance on ITGCs. • Set direction and measure the program: Define what a mature program looks like, set the roadmap and KPIs to get there, and report progress to security leadership each quarter. • Embed GRC by design: Track product roadmaps and supporting infrastructure with Product and Engineering. You will assess how launches and material changes affect audit scope and system boundaries, and build lightweight checkpoints into product discovery. • Scale through AI and automation: Build repeatable processes, runbooks, and AI-driven automation for evidence, testing, scoping, and audit requests.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT