Hevo is a fully-managed, no-code data pipeline platform that helps organizations move, transform, and activate their data in real time. With 150+ pre-built, battle-tested connectors, Hevo lets data teams focus on insights instead of pipeline maintenance — trusted by 2,000+ organizations globally to keep their data flowing reliably, securely, and in compliance with standards like SOC 2, GDPR, CCPA, DORA and HIPAA.
About the RoleAs Hevo's enterprise customer base grows, security and compliance reviews are an increasingly visible part of how deals get done. We're looking for a Senior Compliance Engineer to own our GRC program end-to-end — audits, risk, vendor management, and policy — and to be the technical face of security and compliance to customers and prospects during due diligence. Strong communication is essential: this role is regularly customer-facing and needs to translate technical detail into language that builds trust.
What You'll DoOwn and operate our compliance programs (SOC 2, GDPR, HIPAA, DORA, DPDP as applicable) end-to-end — control implementation, evidence collection, and audit management
Be the primary point of contact for external auditors; manage audit timelines and evidence collection
Own the risk assessment program — identify, assess, score, track, and report risks via a risk register
Manage vendor and third-party risk assessments and due diligence
Respond to customer and prospect security questionnaires (RFPs, due-diligence requests, trust-portal access) with accuracy and speed — a high-visibility, customer-facing part of this role
Support Sales and Customer Success on security & compliance calls with prospects and customers, translating technical controls into business language
Draft, maintain, and drive review of security policies and procedures
Track and report on compliance posture and drift to leadership
Partner with engineering and security teams to close compliance gaps pragmatically, balancing rigor with velocity
Use GRC tooling (e.g., Sprinto, Vanta, Drata, or similar) to automate evidence collection and monitoring
4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)
Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end
Strong understanding of data protection & privacy — GDPR, HIPAA, PII/PHI handling
Proven ability to manage vendor/third-party risk assessments
Excellent written and verbal communication — comfortable presenting to and negotiating with external customers, auditors, and executives
Experience responding to customer security questionnaires / RFPs
Working knowledge of cloud environments (AWS) — enough to assess and discuss controls with engineering
Strong organizational skills — able to manage multiple audits and timelines independently
Experience with GRC automation platforms (Sprinto, Vanta, Drata, OneTrust)
Relevant certifications (CISA, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP)
Experience in a B2B SaaS company handling enterprise customer data
Skills Required
- 4+ years of experience in GRC, compliance engineering, compliance, audit, or information security
- Hands-on experience running SOC 2, ISO 27001, or similar audits end-to-end
- Strong understanding of data protection and privacy, including GDPR, HIPAA, PII, and PHI handling
- Experience managing vendor and third-party risk assessments
- Excellent written and verbal communication skills, including presenting to and negotiating with customers, auditors, and executives
- Experience responding to customer security questionnaires and RFPs
- Working knowledge of AWS cloud environments and ability to assess controls with engineering teams
- Strong organizational skills and ability to independently manage multiple audits and timelines
- Experience with GRC automation platforms such as Sprinto, Vanta, Drata, or OneTrust
- Relevant certification such as CISA, CRISC, ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, or CIPP
- Experience in a B2B SaaS company handling enterprise customer data
What We Do
Hevo is an Automated Unified Data Platform that helps companies understand their users and customers better. Using Hevo, companies can build a 360-degree view of their customers by combining data from multiple disparate data sources and applications including sales CRM, advertising channels, marketing tech, financial system software, and customer support products. Data and information stored in these applications are often siloed, and it's difficult for companies to get a complete view of their customers and business metrics. Hevo solves this problem for its customers.
