Compliance Program Manager
Upload My Resume
Drop here or click to browse · PDF, DOCX, DOC, RTF, TXT
Requirements
• 6+ years in security engineering, cloud security, or compliance-focused security roles • security engineering, cloud security, or compliance-focused security roles • Hands-on experience supporting SOC 2, ISO 27001, GDPR, DORA, or similar regulatory frameworks • SOC 2, ISO 27001, GDPR, DORA, or similar regulatory frameworks • Ability to translate regulatory requirements into technical controls • technical controls • Strong working knowledge of AWS security fundamentals (IAM, logging, encryption, networking) • AWS security fundamentals • Comfortable owning auditor interactions and explaining systems clearly • Experience building or automating security/compliance processes (Python, Bash, Go, etc.) • If you’ve never been accountable for an audit outcome, this role is not a fit. • Experience securing Kubernetes environments • Familiarity with AppSec tooling (SAST/DAST, manual testing) • Experience with AWS security services (GuardDuty, Config, Security Hub) • Prior work in fintech, payments, or regulated infrastructure • Security or compliance certifications (CISSP, CISA, ISO 27001 Lead Implementer, AWS Security)
Responsibilities
• Own audit-ready security controls • Design, implement, and maintain technical and operational controls for SOC 2, ISO 27001, GDPR, DORA, and future regional requirements • Ensure controls are not just documented, but actually enforced in AWS, Kubernetes, and application layers • Be the technical counterpart to Legal, Compliance & Risk • Translate regulatory language into concrete security mechanisms • Partner with Legal/Compliance to monitor new regulations and assess technical impact • Decide what is “good enough” vs. over-engineered for compliance • Run audits instead of reacting to them • Own audit preparation, evidence collection, walkthroughs, and remediation tracking • Build repeatable, automated evidence pipelines instead of last-minute scrambles • Be the person auditors trust when they ask, “Show me how this actually works” • Embed compliance into the platform • Work with engineering to design systems that are secure by default and defensible to regulators • Ensure logging, access controls, encryption, monitoring, and change management meet regulatory expectations • Automate compliance wherever possible • Build tooling/scripts to continuously validate controls (access reviews, logging coverage, config drift, etc.) • Reduce manual compliance work over time by pushing checks into code and infrastructure • What Success Looks Like • You’ll know you’re succeeding if: • SOC 2 / ISO 27001 audits complete with zero high-severity findings • Establish control ownership, governance cadence, and compliance roadmap as the company scales • GDPR and DORA compliance readiness, including regulator-facing engagement and response • Regulatory requests are answered with evidence, not explanations • New regional regulatory requirements are implemented without blocking launches • Audit prep time decreases quarter-over-quarter due to automation • Engineering teams ship features without creating compliance debt • If audits feel boring and predictable, you’re doing the job well. • Shape how OpenFX proves trust to regulators, banks, and institutions • Decide how security controls are implemented - not just documented • See the immediate impact of your work on global expansion • You’ll learn how to build compliance that scales, not compliance that slows teams down - a skillset that’s rare and extremely valuable in fintech. • compliance that scales • This Role Is Not For You If: • You prefer compliance as primarily coordinating between teams rather than owning control execution end-to-end • You approach audits by repeatedly pulling time and evidence from engineering instead of building scalable, audit-ready processes • You are not comfortable driving documentation, evidence automation, and regulator-facing accountability • You prefer compliance to remain a distributed responsibility rather than taking full ownership of outcomes
Benefits
• This is not a checkbox compliance role.