Compliance & Security Lead

Location: Remote or hybrid in the UK. Remote employees must work within CET to ET timezones (GMT+1:00 to GMT-5:00); three in-person events are held annually.

Company

hirify.global is an open-source platform and managed cloud service for building and running production-grade AI agents and asynchronous workloads at scale.

What you will do

• Own the SOC 2 Type II and HIPAA compliance programs, including audits, evidence collection in Oneleet, and year-round audit readiness.
• Use AI and automation to accelerate questionnaire responses, evidence collection, policy review, and compliance operations.
• Complete security questionnaires and vendor assessments, maintain the trust portal, and manage security reports and bridge letters.
• Review and negotiate DPAs with customers and suppliers, maintain records of processing, and handle UK and EU GDPR data subject requests.
• Maintain security, privacy, and data retention policies; review tools and subprocessors; and determine when to introduce frameworks such as ISO 27001 or ISO 42001.
• Maintain onboarding, incident response, breach notification, and automated evidence-collection processes, including annual testing.

Requirements

• 5+ years of experience in security compliance, GRC, or data protection, ideally in a SaaS or developer tools company.
• Experience as the first or only compliance hire at an early-stage startup, with full ownership of the function.
• Hands-on experience running a SOC 2 audit from evidence collection through the final report.
• Current working knowledge of UK and EU GDPR and experience reviewing or negotiating DPAs.
• Experience completing security questionnaires accurately and quickly.
• Clear, plain writing skills for policies intended for engineers.
• Technical understanding of cloud infrastructure, access control, and logging; coding experience is not required.
• Remote employees must be within CET to ET timezones (GMT+1:00 to GMT-5:00).

Nice to have

• Experience with ISO 27001 or HIPAA.
• Experience with compliance automation platforms such as Oneleet, Vanta, or Drata.
• Privacy or security certification such as CIPP/E, CISA, or CISSP.
• Use of AI tools for questionnaires, evidence review, and policy work.
• Based in the UK and able to join the team in London.

Culture & Benefits

• Small, flat team with autonomous work, continuous learning, and personal development support.
• Open-source and transparent security practices, including published security reports and a trust portal.
• Async working, home-office equipment, private health insurance, and a London dog- and cat-friendly office.
• 25 vacation days excluding national holidays, sick leave, generous parental leave, and a training budget.
• Company pension scheme or contributions to a private pension; equity is also offered.