GRC and Security Compliance Lead

Deepgram, USA - Remote

The role

Deepgram is looking for a GRC and Security Compliance Lead to own the written and evidentiary backbone of our security and privacy program — the documents and evidence that auditors, enterprise customers, and our own engineers rely on to know what we actually do.

We hold SOC 2, ISO 27001, and PCI DSS obligations, we answer a steady stream of enterprise security questionnaires, and we publish public commitments about how we handle data and how our models are built. Today that work is spread across too few people. You will own it: the evidence, the policies, the public posture documents, and the system that keeps all three consistent with each other.

Context matters here, because the claims you will be writing are unusually specific. Most of our infrastructure is bare metal in colocation datacenters — containerized on Docker, managed with Ansible, and deployed through GitHub Actions — with AWS used for overflow capacity and a small set of services. That means our control environment spans physical and colocation controls, on-premise hosts, and cloud, not a single cloud provider's shared-responsibility model.

All jobs

GRC and Security Compliance Lead

Deepgram, USA - Remote

The role

What you will do

Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS — what evidence is required, who produces it, where it lives, and whether it would actually satisfy a reviewer. Be the auditor's primary point of contact through fieldwork.
Own control mapping across frameworks. Build and maintain the crosswalk so one control and one piece of evidence satisfies SOC 2, ISO 27001, PCI DSS, and customer questionnaires — rather than running the same work three times.
Own the colocation and infrastructure vendor side of compliance: datacenter provider SOC reports and attestations, physical security and carve-out language, and how shared responsibility actually divides between us and each provider.
Own security questionnaires and the security sections of RFPs. Maintain the answer library, keep it current as the product changes, and know which answers to fight for and which to concede.
Author and own the lifecycle of our internal policies and standards: drafting, review and approval cycles, annual review, exceptions and carve-outs, and retiring what no longer reflects reality.
Own our public-facing posture documents — Trust Center content, the AI Safety statement, Model Cards (with Research), the Privacy Policy (with Legal), and the deployment-model and self-hosted documentation customers rely on during review.
Own the documentation system itself: where documents live, how they are versioned and reviewed, and how a customer-facing claim traces back to an internal source of truth. Nothing we say publicly should be unattributable.
Maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments — and own the process that keeps them accurate as the product changes.
Run compliance and security awareness training and enablement, including clear guidance to Sales Engineering on what they may and may not commit to on a customer call.
Partner with Security Engineering so evidence is generated once, by automation — from Ansible, GitHub, and our logging and monitoring stack — and reused, and flag where a manual evidence pull should become an automated one.
Support the privacy program: contribute to DPIAs and transfer impact assessments, subprocessor and vendor privacy reviews, and DSAR intake, in partnership with the Privacy Operations Lead.

GRC and Security Compliance Lead

The role

GRC and Security Compliance Lead

The role

What you will do

What you need

Nice to have

Company operating rhythm

About Deepgram

Similar jobs at other companies

Software Engineer - Deepgram for Restaurants

Research Scientist, Voice

GRC Engineer

Senior Security GRC Lead

GRC Engineer

Security GRC Lead

Deepgram