Compliance Manager

About the role

Anyscale is a company focused on democratizing distributed computing and supporting the adoption of Ray, an open-source project for scalable machine learning. Key clients include OpenAI, Uber, Spotify, Instacart, and Cruise. Anyscale is backed by notable investors such as Andreessen Horowitz, NEA, and Addition.

Responsibilities

• Own SOC 2 Type II and ISO 27001 programs, including scope, evidence, control operation, and the relationship with external auditors.
• Complete the control evidence base in compliance automation platforms, moving controls from partially substantiated to audit-ready status.
• Lead security diligence for enterprise and regulated customers, including security questionnaires, audit responses, right-to-audit requests, and recurring reporting.
• Own the risk register and develop it into a mature, enterprise-aligned program.
• Coordinate compliance obligations related to customer contracts, such as data protection, breach-notification timelines, and vendor/subprocessor assessments, working closely with legal.
• Assess and set up new certifications as needed based on customer requirements.
• Partner with engineering and IT to integrate evidence collection into system operations, reducing manual effort before audits.

Requirements

The ideal candidate should have 7+ years of experience in governance, risk, and compliance, particularly in high-growth startups. Experience owning SOC 2 and ISO 27001 programs, including auditing, is essential. Demonstrated ability to handle security diligence for enterprise or regulated customers is also required.

Qualifications

• Fluency with compliance automation platforms and the ability to turn tools into audit-ready evidence.
• A strong understanding of security controls and their application in cloud and SaaS environments.
• Strong judgment and communication skills to manage a compliance program independently and coordinate across different teams.

Skills

• Experience with regulated-customer contractual security obligations, such as data protection agreements, breach notification, and right-to-audit provisions.
• Exposure to newer or higher-bar frameworks and familiarity with cloud infrastructure or AI/ML platforms.

Benefits

Not applicable.

Pay

Not applicable.

Schedule

Not applicable.