Security Compliance Lead
Plaid · Remote United States
About this role
## About the team Plaid’s Security Governance, Risk, and Compliance (GRC) team enables the business by proactively managing information security risk and maintaining effective controls. We partner across the company to keep Plaid’s platform secure, resilient, and aligned with industry and regulatory expectations. Our assurance program builds trust with customers, consumers, and data partners. Core compliance is how we prove it—running certifications, audits, and regulatory obligations so banks, customers, and regulators can rely on Plaid, and keeping them aligned as products evolve. ## About the role As **Security Compliance Lead**, you’ll be the single accountable owner of Plaid’s core security compliance program, including **SOC 2 Type 2**, **ISO 27001**, **ISO 27701**, and related governance obligations. You’ll set the program’s structure and direction with a roadmap and KPIs that turn compliance from a pass/fail event into something leadership can steer. You’ll build a control catalog that supports multiple obligations (e.g., SOC 2 through **FedRAMP**), and run internal audits to find gaps before external auditors, customers, or regulators do. You’ll also ensure compliance shapes product decisions before launch, and scale the program using **AI and automation** as Plaid expands into new products, markets, and frameworks. ## Responsibilities - **Own the compliance program and governance calendar** - Lead **SOC 2 Type 2**, **ISO 27001**, and **ISO 27701** end to end - Run annual and quarterly governance obligations (policy reviews, access/change-management reviews, security training, vendor reviews, and regulatory/bank/partner assessments), ensuring each has an owner, due date, and evidence of completion - **Build and own the control catalog** - Design and maintain a control catalog mapped across every framework Plaid reports against - Build to **FedRAMP** and **NIST 800-53** depth, with clear control owners, quarterly owner certification, and testing - **Run internal audit and policy assurance** - Create a risk-based internal audit plan to test operating effectiveness and policy adherence - Own the policy lifecycle and track findings through remediation - Partner with Finance on **ITGCs** - **Set direction and measure the program** - Define what a mature program looks like - Set the roadmap and KPIs, and report progress to security leadership each quarter - **Embed GRC by design** - Partner with Product and Engineering to assess how launches and material changes affect audit scope and system boundaries - Build lightweight checkpoints into product discovery - **Scale through AI and automation** - Build repeatable processes, runbooks, and AI-driven automation for evidence, testing, scoping, and audit requests ## Qualifications ### Must haves - **Compliance program ownership** - Accountable owner of **SOC 2 Type 2** and **ISO 27001/27701** programs through multiple audit cycles (including roadmap and KPI maturation) - Built or rebuilt a common control framework mapped across multiple frameworks, with control owners and testing - **FedRAMP** - Hands-on experience with **FedRAMP Rev5 or 20x**: **NIST 800-53** control implementation, boundary and **SSP** documentation, third-party assessment, and continuous monitoring - **Internal audit, policy assurance, ITGC, and SOX** - Planned and run risk-based internal audits testing operating effectiveness and policy adherence - Drove findings to remediation
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.