Responsibilities
- Lead and manage end-to-end compliance for SOC 2 and HIPAA, covering scope definition, control development, evidence gathering, and tracking corrective actions.
- Prepare for and execute audits across evolving regulatory frameworks such as ISO 27001, FedRAMP, NIST 800-53, CMMC, and ISO 42001 as business expands.
- Oversee the complete audit lifecycle, acting as the main liaison for internal and external auditors, assessors, and regulatory bodies.
- Maintain a centralized risk register and conduct regular assessments across personnel, processes, and technology environments.
- Develop, document, and implement security policies, standards, and procedures that align with industry best practices and organizational risk tolerance.
- Manage a unified control framework in Drata, ensuring consistency across overlapping compliance requirements and reducing redundant efforts.
- Drive continuous improvement in compliance through automated monitoring, ongoing evidence collection, and routine control testing.
- Establish key risk and performance indicators to provide executive leadership with timely insights into security program effectiveness.
- Detect deficiencies in existing controls, analyze underlying causes, and coordinate remediation with relevant stakeholders.
- Strengthen third-party risk management by conducting security evaluations, enforcing contractual terms, and monitoring vendor compliance over time.
- Work with Legal to ensure data processing agreements, business associate agreements, and security clauses meet legal and client expectations.
- Represent the organization in customer-facing discussions related to security, including RFP responses and due diligence meetings.
- Maintain up-to-date trust materials such as SOC 2 reports, security questionnaires, and public-facing trust center content.
- Convert external compliance and customer requirements into internal program enhancements.
- Collaborate with security, compliance, and engineering teams to verify controls are properly designed and functioning as intended.
- Coordinate with cross-functional departments including Legal, HR, IT, and Finance to align on shared responsibilities for control implementation.
Governance, Risk & Control Design
- Maintain Trase's enterprise risk register, conducting recurring risk assessments across people, process, and technology.
- Design, document, and operationalize security policies, standards, and procedures aligned to industry frameworks and Trase's risk appetite.
- Own our common control framework in Drata, monitoring and refining controls across overlapping regimes to minimize duplication and audit burden.
Continuous Monitoring & Control Assurance
- Shift Trase's compliance posture from reactive to proactive by implementing continuous control monitoring, automated evidence collection, and recurring control testing.
- Define KRIs, KPIs, and reporting cadences that give leadership real-time visibility into the health of the security program.
- Identify control gaps, perform root cause analysis, and drive remediation in partnership with control owners across the enterprise.
Vendor & Third-Party Risk
- Enhance and operate Trase's third-party risk management program, including vendor security reviews, ongoing monitoring, and contractual security requirements.
- Partner with Legal to ensure DPAs, BAAs, and security addenda meet regulatory and customer requirements.
Customer Trust & Sales Enablement
- Serve alongside other subject matter experts or leaders, as a senior representative in customer security reviews, RFPs, and prospect-facing trust conversations.
- Maintain trust collateral (SOC 2 reports, security questionnaires, trust portal content) and reduce friction in customer due diligence.
- Translate customer and regulator expectations into actionable program requirements.
Cross-Functional Partnership
- Partner closely with peers within Trase Security and Compliance, Engineering, and across the enterprise to ensure controls are operating effectively, as designed.
- Collaborate with Legal, HR, IT, and Finance on shared control ownership and program execution.
