• Own Drata end to end — administration, integrations, monitoring test health, and the manual evidence collection automation doesn't reach.
• Curate the SafeBase knowledge base so sales can self-serve most customer security questionnaires — and be the escalation point for the ones they can't.
• Drive personnel compliance: policy acknowledgments, device compliance, and recurring security and compliance training. This means chasing people down and building the habit, not just running the report.
• Lead recurring ceremonies: user access reviews, penetration tests, BCDR and incident response tabletops, annual policy review and updates, risk assessments.
• Work directly with Engineering on product-related compliance questions, from data handling to customer commitments.
• Maintain audit readiness across SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.
• Translate emerging AI regulation into controls we can actually operate, rather than waiting for someone else's checklist.
• Partner with HR, Legal, Customer Support, and Finance so compliance fits into work that's already happening.