Compliance Manager
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. Output ONLY the HTML fragment — no /, no markdown code fences.
Thus we need to extract sections: About The Role, About The Team, Responsibilities, Required Qualifications, Preferred Qualifications, What Success And Impact Looks Like In This Role, Benefits (from later part). Also maybe "Why Join Relay?" earlier but that's more marketing; but we have a "Why Join Relay?" section earlier with bullet points: "A Proven Winner", "High Value, High Impact", etc. That could be considered Benefits? Actually it's more about why join. Could be considered "Why Join Relay?" but not in the list of allowed headings; but we could treat as "About the company" maybe not needed. The instruction says we can use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should map content accordingly.
We have "About The Role" (prose). "About The Team" (prose). Responsibilities (list). Required Qualifications (list). Preferred Qualifications (list). What Success And Impact Looks Like In This Role (list or prose). Benefits: from later part: "At Relay, We Offer 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents Generous Paid Time Off 401(k) Savings Plan + Company Match Baby Cash Reward + Paid Parental Leave Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it. Latest tech, standing desks, and all the tools and software you need to thrive". That's benefits.
We should not include Pay or Schedule as not present.
We need to avoid duplication: there is a duplicated "Why Join Relay?" earlier and later; we should not repeat. We'll include Benefits section only once.
We need to remove EEO boilerplate etc.
We need to preserve all substantive info.
We need to format lists with
- . For prose sections use
.
We need to ensure we don't create empty sections.
Let's craft HTML:
About the Role
... content from About The Role ...
About the Team
... content from About The Team ...
Responsibilities
- Own Relay's compliance certification portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — including the master certification schedule, audit readiness, and on-time completion of every engagement.
- Serve as Relay's Drata subject matter expert: administer the platform, maintain control mapping and continuous monitoring, manage evidence collection workflows, and drive adoption across control owners.
- Manage the relationship with our external auditors directly from within Drata — coordinate audit windows, fieldwork, evidence requests, findings, and remediation through to report issuance.
- Run the internal audit program: plan and execute control testing, document results, track findings to remediation, and prepare the organization ahead of every external audit.
- Own control management across all frameworks — maintain the unified control library, assign and support control owners, monitor control health, and remediate gaps and drift.
- Own the policy management lifecycle — draft, review, update, route for approval, publish, and track attestation of security and compliance policies on their required cadence.
- Own third-party vendor risk management: security and compliance reviews for new vendors, periodic reassessments, vendor documentation, and risk tracking through to acceptance or remediation.
- Partner with department leaders across the company to assign compliance responsibilities, communicate requirements in plain language, and hold owners accountable to deadlines with firmness and tact.
- Support customer trust activities, including security questionnaires, customer audit requests, and maintenance of compliance documentation and the trust center.
- Report compliance posture, audit status, risks, and program metrics to security leadership and the Security Steering Committee on a regular cadence.
Required Qualifications
- A degree in Computer Science, IT, or a security-related discipline; equivalent compliance certifications (CRISC, CGRC, GRCP, CISM, or CISA) will be considered in place of a formal degree.
- 5+ years of experience in information security compliance, GRC, or audit roles, with at least 2 years directly managing certification programs.
- Hands-on experience running SOC 2 Type II audits end-to-end, including auditor management, evidence collection, and remediation.
- Working knowledge of HIPAA security requirements, ISO 27001:2022 (including ISMS operation and surveillance/recertification audits), and PCI DSS.
- Expert-level proficiency with Drata or a comparable GRC/compliance automation platform (Vanta, Secureframe, Hyperproof), including control mapping, monitoring, and auditor collaboration workflows.
- Demonstrated experience managing external audit firms through complete audit cycles.
- Experience building and running internal audit and control testing programs.
- Experience owning policy management and third-party vendor risk programs.
- Exceptional interpersonal and communication skills: you can translate framework requirements into plain language for any department leader, drive accountability without creating friction, and set a tone that makes compliance a partnership.
- Strong organizational and project management skills — you can run multiple concurrent audit timelines without letting anything slip.
Preferred Qualifications
- Relevant certifications such as CISA, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP.
- Experience adding new frameworks to an existing program (e.g., HIPAA, NIST, or FedRamp onto an ISO 27001 foundation).
- Experience in a fast-paced, cloud-first SaaS environment serving enterprise customers.
- Familiarity with security tooling that feeds compliance evidence (endpoint protection, identity management, awareness training platforms).
- Experience presenting to management, leadership and steering committees.
What Success And Impact Looks Like In This Role
- Every certification in the portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — is completed on schedule with no lapses and minimal findings.
- Drata is fully operationalized: controls mapped across frameworks, continuous monitoring healthy, evidence automated wherever possible, and Auditors working seamlessly within the platform.
- The internal audit program surfaces and closes gaps before external auditors find them.
- Policies are current, approved, and attested on schedule; the vendor risk program has full coverage of Relay's third parties with no aging reviews.
- Department leaders view compliance as a well-run partnership — requirements are clear, deadlines are met, and escalations are rare because the relationships are strong.
Benefits
- 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents
- Generous Paid Time Off
- 401(k) Savings Plan + Company Match
- Baby Cash Reward + Paid Parental Leave
- Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling
- Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it
- Latest tech, standing desks, and all the tools and software you need to thrive
We need to ensure no duplicate content. Also we might include a short paragraph about "Why Join Relay?" but that's covered partially in benefits? The earlier "Why Join Relay?" had bullet points: "A Proven Winner: Join a hyper-growth company trusted by over 10% of the Fortune 500, continuing to move upmarket with massive impact. High Value, High Impact: With 47% of our revenue from $100K+ ARR customers and 135% Net Revenue Retention (NRR), you'll be joining a company rooted in value creation. Market-Leading Innovation: The Relay platform captures 1 billion new data points weekly and features award-winning AI tools like TeamTranslate™, with 500% YoY growth. World-Class Leadership: Our stellar leadership team is built to help us scale toward our next major milestones. The Relay Culture: We’re dedicated to helping you do the best work of your life (BWIML), investing in your growth through L.I.T., living our CHASE values, and learning from incredibly talented, supportive teammates who make the work (and the wins) better every day." This is substantive and not covered elsewhere. Should we include a section? The allowed headings include "About the role", "Responsibilities", "Requirements", "Qualifications", "Skills", "Benefits", "Pay", "Schedule". There's no "About the company" or "Why join". But we could incorporate that into Benefits? Not really. However instruction says "Prefer a few substantive sections over many thin ones." Could we add a section "About the Company" using ? Not in the list but maybe allowed as a heading? The instruction says "Use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The e.g. suggests those are examples, not exclusive. But they say "include a section ONLY when the posting has real, specific content for it". So we could add a section like "About Relay" or "Why Join Relay". However they'd prefer fewer sections. But the content is substantive and not duplicated elsewhere. I'd include a section "About Relay" (or "Why Join Relay") as an with prose summarizing those points. That seems appropriate.
Thus add:
About Relay
Relay is the Intelligent System of Action for
for prose. Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless the posting actually states them. Prefer a few substantive sections over many thin ones. Output ONLY the HTML fragment — no /, no markdown code fences. Thus we need to extract sections: About The Role, About The Team, Responsibilities, Required Qualifications, Preferred Qualifications, What Success And Impact Looks Like In This Role, Benefits (from later part). Also maybe "Why Join Relay?" earlier but that's more marketing; but we have a "Why Join Relay?" section earlier with bullet points: "A Proven Winner", "High Value, High Impact", etc. That could be considered Benefits? Actually it's more about why join. Could be considered "Why Join Relay?" but not in the list of allowed headings; but we could treat as "About the company" maybe not needed. The instruction says we can use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should map content accordingly. We have "About The Role" (prose). "About The Team" (prose). Responsibilities (list). Required Qualifications (list). Preferred Qualifications (list). What Success And Impact Looks Like In This Role (list or prose). Benefits: from later part: "At Relay, We Offer 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents Generous Paid Time Off 401(k) Savings Plan + Company Match Baby Cash Reward + Paid Parental Leave Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it. Latest tech, standing desks, and all the tools and software you need to thrive". That's benefits. We should not include Pay or Schedule as not present. We need to avoid duplication: there is a duplicated "Why Join Relay?" earlier and later; we should not repeat. We'll include Benefits section only once. We need to remove EEO boilerplate etc. We need to preserve all substantive info. We need to format lists with
- . For prose sections use
. We need to ensure we don't create empty sections. Let's craft HTML:
About the Role
... content from About The Role ...
About the Team
... content from About The Team ...
Responsibilities
- Own Relay's compliance certification portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — including the master certification schedule, audit readiness, and on-time completion of every engagement.
- Serve as Relay's Drata subject matter expert: administer the platform, maintain control mapping and continuous monitoring, manage evidence collection workflows, and drive adoption across control owners.
- Manage the relationship with our external auditors directly from within Drata — coordinate audit windows, fieldwork, evidence requests, findings, and remediation through to report issuance.
- Run the internal audit program: plan and execute control testing, document results, track findings to remediation, and prepare the organization ahead of every external audit.
- Own control management across all frameworks — maintain the unified control library, assign and support control owners, monitor control health, and remediate gaps and drift.
- Own the policy management lifecycle — draft, review, update, route for approval, publish, and track attestation of security and compliance policies on their required cadence.
- Own third-party vendor risk management: security and compliance reviews for new vendors, periodic reassessments, vendor documentation, and risk tracking through to acceptance or remediation.
- Partner with department leaders across the company to assign compliance responsibilities, communicate requirements in plain language, and hold owners accountable to deadlines with firmness and tact.
- Support customer trust activities, including security questionnaires, customer audit requests, and maintenance of compliance documentation and the trust center.
- Report compliance posture, audit status, risks, and program metrics to security leadership and the Security Steering Committee on a regular cadence.
Required Qualifications
- A degree in Computer Science, IT, or a security-related discipline; equivalent compliance certifications (CRISC, CGRC, GRCP, CISM, or CISA) will be considered in place of a formal degree.
- 5+ years of experience in information security compliance, GRC, or audit roles, with at least 2 years directly managing certification programs.
- Hands-on experience running SOC 2 Type II audits end-to-end, including auditor management, evidence collection, and remediation.
- Working knowledge of HIPAA security requirements, ISO 27001:2022 (including ISMS operation and surveillance/recertification audits), and PCI DSS.
- Expert-level proficiency with Drata or a comparable GRC/compliance automation platform (Vanta, Secureframe, Hyperproof), including control mapping, monitoring, and auditor collaboration workflows.
- Demonstrated experience managing external audit firms through complete audit cycles.
- Experience building and running internal audit and control testing programs.
- Experience owning policy management and third-party vendor risk programs.
- Exceptional interpersonal and communication skills: you can translate framework requirements into plain language for any department leader, drive accountability without creating friction, and set a tone that makes compliance a partnership.
- Strong organizational and project management skills — you can run multiple concurrent audit timelines without letting anything slip.
Preferred Qualifications
- Relevant certifications such as CISA, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP.
- Experience adding new frameworks to an existing program (e.g., HIPAA, NIST, or FedRamp onto an ISO 27001 foundation).
- Experience in a fast-paced, cloud-first SaaS environment serving enterprise customers.
- Familiarity with security tooling that feeds compliance evidence (endpoint protection, identity management, awareness training platforms).
- Experience presenting to management, leadership and steering committees.
What Success And Impact Looks Like In This Role
- Every certification in the portfolio — SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS — is completed on schedule with no lapses and minimal findings.
- Drata is fully operationalized: controls mapped across frameworks, continuous monitoring healthy, evidence automated wherever possible, and Auditors working seamlessly within the platform.
- The internal audit program surfaces and closes gaps before external auditors find them.
- Policies are current, approved, and attested on schedule; the vendor risk program has full coverage of Relay's third parties with no aging reviews.
- Department leaders view compliance as a well-run partnership — requirements are clear, deadlines are met, and escalations are rare because the relationships are strong.
Benefits
- 100% Paid Insurance: Health, Dental, Vision, Long/Short Term Disability, and Life Insurance for you and your dependents
- Generous Paid Time Off
- 401(k) Savings Plan + Company Match
- Baby Cash Reward + Paid Parental Leave
- Wellness Perks: If you’re joining our Raleigh-based HQ, you’ll have access to a world-class onsite fitness center with instructor-led classes, plus tennis, basketball, pickleball, and cycling
- Team Events & Culture: From company celebrations to team outings, we work hard and have fun doing it
- Latest tech, standing desks, and all the tools and software you need to thrive
? Not in the list but maybe allowed as a heading? The instruction says "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The e.g. suggests those are examples, not exclusive. But they say "include a section ONLY when the posting has real, specific content for it". So we could add a section like "About Relay" or "Why Join Relay". However they'd prefer fewer sections. But the content is substantive and not duplicated elsewhere. I'd include a section "About Relay" (or "Why Join Relay") as an
with prose summarizing those points. That seems appropriate. Thus add:
About Relay
Relay is the Intelligent System of Action for