Security Compliance Manager

About the role

Own compliance planning and the compliance program across SOC 2 Type II, PCI DSS (Level 1 Service Provider), ISO 27001, GDPR, CCPA, and DORA — responsible for the program’s design and direction, not only its execution.

Drive Sardine's FedRAMP effort by working toward authorization, coordinating NIST SP 800-53 control implementation, 3PAO assessment, and continuous monitoring across engineering and IT.

Serve as the primary interface to auditors, regulators, and industry stakeholders, and partner with internal engineering, IT, product, security, and legal teams to drive reviews to clean outcomes.

Present objectives, scope, and results to senior management and the board (via the CISO), clearly articulating the business impact of control gaps in a highly professional and proficient manner.

Own the control framework — including rationalizing overlapping controls across standards into a coherent, evidence-efficient set — and the security policy and standards library.

Own the risk picture — the risk register, risk quantification, and reporting cadence — and validate that actions taken to address risks are appropriate and reported accurately.

Own the customer assurance and trust program — security questionnaires, attestations, and trust artifacts — so security review does not block deals.

Manage evidence and drive improvement — coordinate the assimilation of evidence, scans, and artifacts, and lead process improvements in response to findings from regulators, internal and external quality reviews, and maturity assessments.

Build product and technical fluency — understand Sardine’s platform and architecture well enough to ground control design and risk decisions in how the technology actually works, and to engage engineering and product as a peer.

Look for creative, alternative solutions that promote consistency and unlock streamlining and automation opportunities.

Produce executive-ready work — high-quality documentation and presentations, and well-run meetings with regulators and internal stakeholders where you set the objectives, plan, and content.

Lead and develop the team — starting with a Security Compliance Analyst — setting priorities, reviewing work, mentoring, and scaling the function as obligations grow.

Requirements

• 7+ years in security compliance, GRC, or audit, including end-to-end ownership of audit or certification programs (SOC 2, PCI DSS, and/or ISO 27001).
• Deep knowledge of security and privacy frameworks — PCI DSS, SOC 2, ISO 27001, GDPR/CCPA, and DORA; familiarity with control frameworks such as NIST CSF and CIS.
• Technical and product comfort — able to build fluency in a technical product (e.g., device intelligence, behavioral biometrics, transaction monitoring) and hold your own with engineering and product teams.
• Excellent communication — strong written and verbal skills, executive-ready documentation, and credible presence with auditors, regulators, and leadership.
• Fast-paced, high-growth experience — fintech or payments strongly preferred given Sardine’s PCI Level 1 service provider obligations.
• Able to work as a leader, a partner, and an individual contributor as the situation calls for, and to travel as needed.
• People leadership — experience leading, mentoring, or managing others, or clear readiness to step into managing a direct report.
• Bonus points: Direct experience running a PCI DSS Level 1 service provider program. Operational resilience — hands-on exposure to DORA requirements. Tooling — familiarity with GRC and security tooling (compliance automation platforms such as Vanta; HRIS such as Rippling) and with macOS environments.

Qualifications

• BS/BA degree in Computer Science, Information Systems, or related field.
• CISSP, CISM, or equivalent certifications preferred.