Compliance Program Manager

Description

The company is growing fast and building a database platform that gives developers Postgres and Vitess/MySQL databases that are fast and reliable, for workloads of any size.

It has raised more than $100M in venture financing from leading venture firms. Customers include Block, Anysphere (Cursor), MyFitnessPal, Etsy, Kick, and thousands of others, and they trust the company with their data, which matters a great deal to them.

The role oversees the FedRAMP certification process and the ongoing running and development of existing compliance commitments, including SOC 1, SOC 2, and PCI DSS. The security and compliance team runs the corporate information security program to reduce risk across systems and build trust in products, features, and cloud services, serving both internal staff and external customers and partners.

The posting also describes a Customer Support Engineer role: you would help developers and businesses solve real production problems and help shape the product, documentation, and support systems.

Responsibilities

• Own the FedRAMP readiness and ATO process from beginning to end.
• Serve as the main compliance contact for every audit and assessment, including SOC 1 and SOC 2, PCI, and FedRAMP. This covers audit planning, reviewing documents and evidence, assessing procedures, and walking external auditors through controls.
• Define, track, and report on key performance indicators and maturity metrics for audit and compliance programs.
• Work with IT, Engineering, Legal, and People to identify, manage, and deliver solutions for privacy, data protection, and compliance requirements, so the company meets high customer expectations for data protection and privacy.
• Use knowledge of industry standards and best practices to assess current security and compliance risk, find exposure, and close gaps by proposing and putting in place remediating controls.

Requirements

• 5+ years contributing to or managing audits at a technology company, with proven FedRAMP expertise.
• Experience with SOC 2 and the PCI Data Security Standard as a contributor or control owner.
• Experience contributing to or managing company-wide risk assessments.
• Strong written and verbal communication, able to explain compliance and privacy concepts to technical and non-technical audiences.
• Proven ability to work with external auditors, outside consultants, and legal affairs.
• Comfort working remotely and asynchronously across many teams and time zones.
• Working knowledge of cloud providers such as AWS, Azure, and GCP, and how to work with them.
• Experience with databases, developer tools, infrastructure, or other technical products.
• Highly organized, able to work in a startup, and comfortable with ambiguity and change.
• Able to work across departments without organizational silos, and motivated to lead programs that help the organization succeed.
• Understanding that security and compliance programs generate revenue and affect the company's ability to sell to and keep demanding customers.
• Willing to challenge the status quo while staying focused on keeping the company secure and earning customer trust.
• Preferred: CISSP, CISA, or CISM certification.
• Preferred: working knowledge of SQL, ideally with MySQL and/or PostgreSQL experience.

Conditions

Remote-first team, with much of the work done asynchronously across time zones.

Base salary range: $175,000 - $200,000 USD.

The company welcomes applicants regardless of educational background, gender identity, sexual orientation, religion, ethnicity, age, citizenship, socioeconomic status, disability, pregnancy status, or veteran status, and will adjust the interview process for disabilities on request.

Benefits

• Total compensation is base salary, variable pay where appropriate, benefits, and equity.
• The company is profitable and recognized as one of the fastest-growing companies in America, with a philosophy built on small teams of p99 people.