SOC2 Compliance Integration Engineer

We're a B2B audience intelligence and identity resolution platform. Our stack is AWS-native and data-heavy: Serverless EMR/Spark for large-scale pipeline processing, S3 for staging and delivery, ClickHouse and PostgreSQL for analytical and application data, and managed ETL/activation tooling (Fivetran) for downstream destinations. We're a small engineering team, so we move quickly and we build and own most of our own infrastructure. We're pursuing SOC 2 Type II to support enterprise sales. We want it done properly rather than performatively — a report that survives a real security review, not a folder of policy PDFs. What we're hiring for We need someone to own SOC 2 readiness and implementation, and to be our side of the table during the audit itself. To be explicit about what this role is not: we understand the audit report must be issued by an independent licensed CPA firm, and that the same party cannot both implement controls and attest to them. We'll engage an audit firm separately. You would help us select that firm and manage the engagement from our side. Scope of work: Readiness gap assessment against the Trust Services Criteria — Security and Confidentiality (adjust if you're adding Availability or Privacy) Written policy set tailored to our actual environment, not template boilerplate Compliance platform selection and configuration (Vanta, Drata, Secureframe, or similar) including evidence automation Control design and rollout: access reviews, change management wired into our existing CI/CD, logging and monitoring, incident response, business continuity Vendor and subprocessor risk management — this is a significant piece of work for us given the number of data suppliers and downstream destinations in our pipeline Data retention, deletion, and handling documentation appropriate to an identity resolution business Audit support: managing evidence requests, translating auditor questions for our engineers, and pushing back where a request doesn't apply to our architecture Recommend and help evaluate audit firms with experience in data infrastructure Required experience You have taken at least two companies from no formal compliance program to a clean SOC 2 Type II Hands-on AWS security experience — IAM role and policy design, S3 access controls and encryption, VPC and network boundaries, CloudTrail and logging. You should be comfortable reading our infrastructure rather than asking us to summarize it for you. Direct working experience with at least one major compliance automation platform You've handled subprocessor and vendor risk for a company with a meaningful third-party data supply chain You write your own policies and can explain every control back to the criteria it satisfies Strong plus Data brokerage, adtech, martech, or identity resolution experience Familiarity with Spark/EMR, ClickHouse, or comparable large-scale analytical infrastructure Working knowledge of CCPA/CPRA data broker obligations, DPAs, and how privacy commitments flow down to vendors Experience taking a company through both Type I and Type II sequentially