Security & Compliance Lead

## Location: Remote (Global) HQ: Bellevue, WA ## Team: Engineering ## Type: Full-Time Deferred Compensation + Bonuses ## Reports To: Chief Technology Officer We are looking for a Security & Compliance Lead to take SunCore Digital to a SOC 2 attestation and own our security compliance program end to end. SOC 2 is an audit performed by an outside licensed firm; your job is everything that makes that audit succeed. You will define the audit scope with the CTO, assess where we stand today against the Trust Services Criteria across our web platform and mobile apps, close the gaps, and manage the auditor relationship through to the final report. You will write the policies, stand up continuous evidence collection, and coordinate the technical work with our engineers, who implement the controls in code and infrastructure. This is an ownership role with checks built in: scope, spend, and major control decisions are approved by the CTO, and your program is expected to hold up under challenge from the engineers who live with it every day. This is a remote-first role with deferred compensation until 60 days post-MVP launch, plus equity, bonuses, and annual offsite perks. We value speed, ownership, and collaborative energy. ## What You'll Do - Define the SOC 2 audit scope with the CTO: which Trust Services Criteria we attest to, and whether we pursue a Type I report, a Type II report, or both in sequence - Run a readiness assessment across the web platform, the mobile apps, our infrastructure, and our vendors, and publish the gap list with owners and dates - Author and maintain the policy set: access control, change management, incident response, vendor management, business continuity, and data handling - Select and deploy a compliance automation platform so evidence is collected continuously by systems rather than assembled by hand before the audit - Coordinate remediation with engineering: you define each control and the evidence it must produce, engineers implement it, and you verify it works - Select the licensed CPA firm, negotiate the engagement, and manage the audit from kickoff through the observation window to the final report - Run security awareness training and the onboarding and offboarding controls for the whole company, not just engineering - Stand up vendor risk review for the third-party services the platform depends on - Coordinate the penetration test: vendor selection, scoping, scheduling, and tracking findings to closure - Report status, risks, and audit blockers directly to the CTO in plain language - After the first report: own the annual audit cycle and keep evidence collection continuous, so the second year is routine instead of a scramble ## What You Bring - 7+ years in information security or governance, risk, and compliance, including at least one SOC 2 program taken from no report to a completed Type II as the internal owner, not as an outside consultant who left before the audit - Working command of the Trust Services Criteria and how auditors actually test them, including mapping controls to the evidence that proves them - Hands-on experience deploying a compliance automation platform such as Vanta, Drata, or Secureframe - Enough technical depth to hold your own with engineers: you can read an architecture diagram, understand cloud access models, CI/CD pipelines, and mobile release processes, and tell a real control from a paper one - Policy writing that people actually follow: short, specific, and enforceable - Experience scoping and managing external auditors and penetration test vendors - A track record of getting compliance work done through engineers you do not manage - Clear written communication, since the audit is won or lost in documents - Bonus: experience in fintech or digital assets, or extending a program beyond SOC 2 into ISO 27001 or privacy regimes such as GDPR and CCPA ## Compensation & Benefits - Competitive pay range: - Offshore mid-senior rates: - Deferred compensation model: All development team compensation is deferred until 60 days post-MVP launch to align incentives, everyone is focused on shipping fast - Annual performance bonus (significant portion of total comp) - Milestone bonuses tied to product delivery - Health, dental, and vision plans for U.S.-based hires - Annual paid offsite (Caribbean, Hawaii, ski destinations) ## Why Join Us You will build our security compliance program from its foundation and take the company to its first SOC 2 report, with a direct line to the CTO and engineers who treat security findings as work to do rather than criticism to deflect. If owning a program end to end, from scope to signed report, is the kind of work you want, we would love to meet you. ## Apply now or reach out directly to [[email protected]](mailto:[email protected])