Security Compliance Lead

The role

You will be the accountable owner of Plaid's core security compliance programs including SOC 2 Type 2, ISO 27001, and ISO 27701. You will build a control catalog, run internal audits, and use AI and automation to scale compliance processes.

What you will do

• Lead SOC 2 Type 2, ISO 27001, and ISO 27701 end to end.
• Run annual and quarterly governance obligations including policy reviews, access and change-management reviews, security training, vendor reviews, and regulatory, bank, and partner assessments.
• Design and maintain a control catalog mapped across frameworks built to FedRAMP and NIST 800-53 depth.
• Build a risk-based internal audit plan to test operating effectiveness and policy adherence.
• Track findings to remediation and partner with Finance on ITGCs.
• Define program maturity, set the roadmap and KPIs, and report progress to security leadership.
• Assess how product launches and material changes affect audit scope and system boundaries.
• Build repeatable processes, runbooks, and AI-driven automation for evidence, testing, scoping, and audit requests.

Required qualifications

• Accountable owner of SOC 2 Type 2 and ISO 27001/27701 programs through multiple audit cycles.
• Experience building or rebuilding a common control framework mapped across multiple frameworks.
• Hands-on FedRAMP experience (Rev5 or 20x) including NIST 800-53 control implementation, boundary and SSP documentation, third-party assessment, and continuous monitoring.
• Experience planning and running risk-based internal audits.
• Experience working with Finance or internal controls teams and external auditors on ITGCs and SOX.
• Experience partnering with Product and Engineering to scope launches and infrastructure changes into audits.
• Experience running a recurring governance calendar.
• AI fluency with experience building AI workflows or automations that reduced manual compliance work.

Nice to have

• Experience with EU financial-services obligations (DORA, central bank IT and cyber assessments, FCA operational and security risk reporting)
• Experience with bank-consortium assessments such as TruSight

Benefits

• Medical
• Dental
• Vision
• 401(k)

About the company

Plaid's Security Governance, Risk, and Compliance (GRC) team enables the business by proactively managing information security risk and maintaining effective controls. The company's mission is to unlock financial freedom for everyone.