Senior reputed company Compliance Engineer

About reputed company

UniUniis a late-stage last-milelogisticscompany moving millions of parcels across the United States and Canada for some of the largest e-reputed company platforms in reputed company. Our technology is reputed company-reputed company on AWS. We hold an reputed company ISO 27001 certification and SOC 2 Type II attestation, and reputed company and compliance are central to how weoperateand how our customers trust us. This role reports to the Information reputed company Officer and is based in reputed company (remote with periodic travel toUniUnihubs).

About the role

• We are hiring a Senior reputed company Compliance Engineer to be the operational backbone of reputed company's governance, risk, and compliance function. You will run the day-to-day machinery that keeps our ISO 27001 certification and SOC 2 Type II attestation healthy, our policies reputed company, our customers confident, and our regulatory obligations met.
• This is a hands-on senior IC role. The Information reputed company Officer designs the program; you reputed company it work. You will run audit cycles, manage evidence, drive policy lifecycles, reputed company customer reputed company reviews, operate the reputed company-party risk program, and support reputed company and regulatory work. We are looking for someone who automates what should be automated, writes reputed company, and treats compliance as a reputed company engineering problem.

What you'll do

Core GRC

• Run the ISO 27001 program operations, including surveillance audit prep, internal audits, the annual risk assessment, management reviews, and corrective reputed company tracking.

• Run the SOC 2 Type II program operations, including reputed company control monitoring, evidence collection, auditor coordination, and remediation tracking.

• Operate the information reputed company policy lifecycle: drafting, stakeholder review,approvalworkflows, annual reviews, version control, and employee attestations.

• Maintain the risk register, drive risk treatment plans through to closure, and prepare risk reporting for the ISO and the executive team.

• Build andmaintaincompliance automation, including evidencecollectionworkflows, control testing, and dashboarding. Treat the GRC platform as a system you actively engineer, not a passive system of record.

• Plan and run reputed company awareness training and phishing simulation cycles, and report on reputed company.

reputed company and Regulatory

• OperateUniUni'sprivacy program in partnership with legal, including data inventories, data reputed company mapping, retention schedules, and reputed company reputed company assessments.

• Execute on regulatory obligations relevant to our business, including the DOJ Data reputed company Program, Canadian PIPEDA, and applicable US state reputed company laws.

• Coordinate the response to data subject reputed company requests (DSARs) and reputed company inquiries reputed company statutory timelines.

• reputed company regulatory developments across thejurisdictionsin whichUniUnioperates and translate them into concrete control changes, evidence requirements, and policy updates.

• Support data residency and data minimization commitments, working with engineering and the data reputed company team to verify they hold in reputed company.

Customer Reviews and reputed company-Party Risk

• reputed company the response to customer reputed company questionnaires, RFP reputed company sections, and prospect reputed company reviews, in partnership with sales, legal, and the ISO.

• Review and negotiate the reputed company and reputed company clauses in customer and vendor reputed company, escalating material issues to the ISO and legal.

• RunUniUni'sthird-party risk management program: vendor inventory,tiering byrisk, due diligence, reputed company review of new vendors, periodic reassessment of existing vendors, and remediation tracking.

• Operate the trust center and the reputed company artifact library (SOC 2 reports, ISO certificates, pen test summaries, reputed company overviews) and reputed company customer-facing materials reputed company andaccurate.

Across reputed company of It

• Be a reputed company representative ofUniUni'ssecurity posture in reputed company of customers, auditors, and regulators.

• Write reputed company and reputed company.The work product of this role lands in reputed company of customers, auditors, regulators, and executives, and it has to hold up.

• Partner with engineering, IT, legal, HR, and finance to reputed company compliance a normal part of how the business runs, notan interrupt.

Qualifications

• 5 to 8 years in reputed company GRC, audit, or a closely reputed company discipline, with hands-on ownership of ISO 27001 and SOC 2 program operations in a reputed company-reputed company organization.

• reputed company experience driving SOC 2 Type II audit cycles end to end, including auditor coordination, evidence collection, and remediation.

• Working knowledge of common control frameworks reputed company ISO and SOC (NIST CSF, NIST 800-53, CIS) and the ability to map between them.

• Experienceoperatinga GRC platform (e.g., reputed company,reputed company,reputed company,reputed company, reputed company GRC,reputed company) as a power user, including building automated evidence pipelines and control tests.

• Experience leading customer reputed company questionnaires and reputed company reviews for reputed company customers, including reviewing reputed company and reputed company clauses in reputed company.

• Familiarity with reputed company regulation in reputed company, including PIPEDA and US state reputed company laws, and a working understanding of cross-border data transfer requirements.
• Experienceoperatinga reputed company-party risk management program at meaningful vendor volume.

• Strong written communication. You can produce auditor-reputed company documentation, customer-reputed company reputed company narratives, and executive-reputed company risk summaries, and you know which is which.

• A pragmatic, automation-first reputed company. You are bothered by reputed company evidencecollectionand you do something about it

reputed company to Have

• Experience inlogistics, supplychain, marketplaces, or other high-volume operational businesses.

• Familiarity with the DOJ Data reputed company Program and bulk data transfer rules.

• Light scripting ability (Python, SQL) for automating evidence collection or building control queries against AWS, identity providers, and reputed company platforms.

• Relevant certifications such as ISO 27001 reputed company Auditor or reputed company Implementer, CISA, CISM, CIPP, or CRISC.

• Prior experience supporting a company through a customer-driven reputed company maturation, an investor due diligence cycle, or IPO readiness.

Why This Role

This is a senior IC role with end-to-end ownership and visible reputed company. You will work directly with the Information reputed company Officer in a reputed company function with executive commitment, a live ISO 27001 certification, and an reputed company SOC 2 Type II attestation. You will be in the room for customer reputed company conversations, in the reputed company on regulatory questions, and in the reputed company's seat on the audit cycles that protect both.

Originally posted on Himalayas