Iso 42001 Compliance Manager Jobs

About Vercel: Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience. Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. About the role: We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London with three days a week in the office. What you’ll do: Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores Manage annual audit deliverables, write treatment plans, and track completion across teams Answer customer compliance inquiries and maintain customer-facing security and compliance documentation What you need: 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review Built security policies and technical controls into the software dev

What you’ll do Own and evolve the Quality Management System (QMS) to support a regulated medical device development program, including design controls and DHF maintenance. Establish and enforce requirements traceability: user needs → design requirements → verification/validation artifacts and change control. Define and run the program-level V&V strategy (verification, validation, and test coverage), including test plans, protocols, reports, and acceptance criteria. Drive risk management activities (e.g., DFMEA / PFMEA, hazard analyses) and ensure mitigations are reflected in requirements and verification. Lead document control: reviews, approvals, training, retention, and audit readiness. Partner with engineering to make quality “native” to the dev workflow (automated testing, release gates, software configuration management). Prepare the program for audits and inspections, including hands-on audit leadership. What we’re looking for Senior experience leading quality for complex hardware + software products in a regulated environment. Deep familiarity with design controls, DHF, document control, risk management, and verification planning. Strong systems thinking and the ability to translate ambiguous product intent into testable requirements. Comfortable collaborating directly with multidisciplinary engineering (recon/ML, embedded, mechanical, EE, cloud). Useful experience Regulated product quality leadership (ISO 13485 / 21 CFR 820 or equivalent), including audit readiness and FDA-facing work. eQMS + document control fluency (e.g., Greenlight Guru) that integrates cleanly with modern engineering workflows.

At Secureframe , we are not just a company; we are at the forefront of revolutionizing cybersecurity compliance. Recognized as one of the industry's most innovative and trusted providers, Secureframe has consistently received accolades for our advanced technology solutions and commitment to excellence. With a robust portfolio of products that safeguard thousands of businesses worldwide, we have been featured in major publications such as Forbes’ next billion dollar startups , TechCrunch, and The Wall Street Journal for our transformative impact on the way companies achieve and maintain compliance standards. As we continue to grow, our mission remains clear: to provide seamless, secure solutions that enable businesses to focus on what they do best. Joining Secureframe means becoming part of a team dedicated to professional excellence and continuous learning in an environment that values creativity and forward-thinking. Secureframe is backed by top VCs including Kleiner Perkins, Accomplice, Gradient Ventures (Google’s AI Fund), BoxGroup, Village Global, and many more. About the role As an Account Executive at Secureframe, you will leverage your established network, ideally built at compliance firms, to drive new revenue by positioning Secureframe’s compliance automation platform within the DiB. You’ll support rapid adoption of CMMC Level 2, DFARS/NIST 800‑171 compliance, converting existing pipeline and trusted relationships in the defense industrial base. Secureframe provides automated tools that streamline compliance across multiple frameworks including SOC 2, ISO 27001, and CMMC 2.0 Secureframe highly values having employees working in-office to foster a collaborative work environment and company culture. For office-based employees (employees who live within a defined radius of a Secureframe office), Secureframe considers working in the office, approximately 30% of the time under current policy, to be an essential function of the employee's role. Benefits Medical,

Fireblocks is the company bringing global finance onchain. Backed by over $1 billion in capital, we are the premier digital asset infrastructure provider trusted by thousands of industry-defining financial institutions, including banks, payment providers, fintechs, and global corporates such as BNY Mellon, BNP Paribas, ANZ Bank, Western Union, Stripe, and Revolut. Built for institutional scale and security, our enterprise-grade platform and network have powered over $14 trillion in digital asset transfers worldwide. About the Role The Sales Engineer, Banking is a technically credible, commercially aware member of the EMEA SE team, responsible for the full technical sales cycle across banking opportunities in Western and Central Europe. This is not a generalist SE role. You will be expected to engage deeply with treasury operations leads, custody technologists, CISOs, and risk committees inside Tier 1 and Tier 2 banks. You will need to understand how institutional banking technology works — core banking platforms, custody and settlement infrastructure, ISO 20022 and SWIFT messaging, and post-trade workflows — and be able to position Fireblocks clearly within that context. You will work closely with Banking-aligned Sales Directors across your region, taking primary responsibility for technical qualification, PoC delivery, RFP responses, and solution design from first engagement through to onboarding handoff. What You'll Do Technical Pre-Sales Lead technical qualification for banking opportunities, distinguishing genuine digital asset programmes from exploratory noise Deliver tailored product demonstrations to technical and executive audiences across custody, settlement, treasury, and compliance use cases Scope, design, and deliver Proofs of Concept in bank environments — including navigating infosec review, sandbox provisioning, and API integration testing Produce and own RFP, RFI, and DDQ responses for banking prospects, maintaining accuracy against Fireblocks'

Tenstorrent is leading the industry on cutting-edge AI technology, revolutionizing performance expectations, ease of use, and cost efficiency. With AI redefining the computing paradigm, solutions must evolve to unify innovations in software models, compilers, platforms, networking, and semiconductors. Our diverse team of technologists have developed a high performance RISC-V CPU from scratch, and share a passion for AI and a deep desire to build the best AI platform possible. We value collaboration, curiosity, and a commitment to solving hard problems. We are growing our team and looking for contributors of all seniorities. We’re looking for a hands-on RTL Design Engineer to own the microarchitecture and RTL implementation of the Power Management Subsystem/Interrupt Controllers/AXI Interconnect/Cache Controller . You’ll collaborate with cross-functional teams—architecture, firmware, software, DV, and PD—to define, design, and optimize power management solutions for next-generation RISC-V/ARM-based SoCs. This role is hybrid, based out of Bangalore, India. We welcome candidates at various experience levels. During the interview process, you will beevaluated and offered a level that aligns with your experience, which may differ from the one in this posting. Who You Are 5–10 years of experience in ASIC/SOC/IP design, with hands-on experience in microarchitecture and RTL development Skilled in Verilog/SystemVerilog and comfortable working across design, debug, and analysis Design and develop microarchitectures for a set of highly configurable IPs Microarchitecture and RTL coding ensuring optimal performance, power, area Work with verification teams on assertions, test plans, debug, coverage, etc. Deep understanding of power management concepts—clocking, reset, DVFS, and low-power modes Familiar with RISC-V or ARM-based SoCs and standard bus protocols (AXI, AHB, APB, CHI) Awareness of functional safety (ISO 26262) practices in hardware design What We Need Abil

Xendit is the financial technology platform built for businesses that move fast. We give companies one unified platform for payment acceptance, payouts, treasury and financial services, replacing fragmented local integrations with a single infrastructure layer. We serve businesses of every size, from high-growth startups to global enterprises, processing high-volume transactions across Southeast Asia and beyond, with more markets on our global expansion roadmap. About the Job At Xendit, we are looking for a mid-level/senior-level IT GRC Analyst to sit at the intersection of technology, compliance, and risk — not just for Indonesia, but across all of Xendit's operating markets. As an individual contributor, you will be responsible for ensuring our IT systems, processes, and controls meet the regulatory obligations and certification standards of every jurisdiction we operate in. You will be our regional GRC go-to person, coordinating directly with regulatory bodies across the regions (Bank Indonesia / OJK, BSP, BOT, etc). Beyond regulatory compliance, you will own and drive the full lifecycle of our IT certifications such as PCI-DSS and ISO 27001. You will work closely with engineering, security, product, and legal teams to embed compliance into how we build and operate. This is a role for someone who is detail-oriented, thrives in multi-market complexity, and can translate a wide range of regulatory requirements into practical, actionable controls in a fast-moving fintech environment. Minimum Qualifications 3–5 years of hands-on experience in IT GRC, IT Risk Management, or IT Compliance roles Solid working knowledge of PCI-DSS, ISO 27001 frameworks, including implementation, certification, and audit readiness Familiarity with Bank Indonesia (BI) and OJK IT governance regulations applicable to payment service providers in Indonesia Exposure to or willingness to take regulatory requirements in at least one other Southeast Asian or international market (e.g., BSP, BOT,

About Syllo Syllo is on a mission to transform litigation. Our product is an AI-powered litigation workspace that enables lawyers and paralegals to safely harness the power of language models throughout the litigation life cycle. Since going to market, we have gained a diverse group of enterprise customers, including some of the biggest law firms in the country, and we are quickly expanding. By reducing the expense of litigation industry-wide, we aim to improve access to high-quality representation and promote the alignment of legal outcomes with merit. We’re looking for a Data Security Compliance Director who will own the compliance-side and business operations related to Company’s data security function. About the role Syllo is a legal technology company building infrastructure that law firms and legal teams trust with sensitive data. Compliance isn't a checkbox here, it's a product feature. We're looking for a Data Security Compliance Director to own our certification programs, manage vendor security relationships and processes, own the accurate and timely completion of our security disclosures in the sales context, and keep our posture audit-ready year-round. This role sits at the intersection of compliance and engineering. While this role does not own the security of our technical stack from an engineering perspective, you will work directly with technical teams to implement controls, close evidence gaps, and translate technical postures and requirements into concrete and well communicated action. Responsibilities - ISO 27001. Maintain and continuously improve our Information Security Management System. Manage internal audits, corrective actions, and annual surveillance cycles through Vanta. - SOC 2 Type II. Coordinate evidence collection, liaise with external auditors, and drive remediation across engineering and operations. - Vendor security. Lead vendor security assessments, manage VSQ responses (inbound and outbound), and maintain a tiered

Zoox's Network Security team architects and defends the digital borders of the company, from corporate offices to engineering labs and product/mission environments. As Staff Network Security Architect, you own the target-state design for how Zoox segments, connects, and controls trust across enterprise IT, OT and lab networks, and hybrid cloud (AWS, GCP). You set the standards other teams build to, you are the security design authority on new infrastructure, and you are accountable for the coherence of the whole picture rather than the health of any one platform. You'll partner closely with Network Engineering, IT, Product Security, Hardware, and Software Engineering, and you'll influence far more systems than you personally operate. In This Role, You Will... Own Zoox's network security reference architecture across corporate, data center, lab/OT, and edge environments, and define the segmentation and trust model that everything else is built against Serve as the security design authority for new infrastructure: run design reviews and threat models early enough to change the design, and define the criteria under which a design is approved, conditionally approved, or rejected Translate security frameworks into buildable engineering standards. Map controls to NIST CSF 2.0, NIST 800-53, and ISO 27001 (IEC 62443 a plus for OT/lab), and turn them into reference patterns, guardrails, and acceptance criteria engineers can implement without interpreting policy Define the zero-trust and identity-to-network strategy, including 802.1X/certificate-based NAC, PKI trust hierarchy, ZTNA and remote access, and how non-human and headless lab/vehicle assets are authenticated and authorized Architect secure hybrid and multi-cloud connectivity (CloudWAN, SD-WAN, transit and inspection architectures, cloud-native controls) and define where inspection, enforcement, and logging belong Drive secure-by-design into the delivery path: encode s

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the Role We are seeking a mid-level AppSec Vulnerability Management Engineer with a strong software development background. In this role, you will bridge the gap between security, compliance, and engineering teams. You will identify application vulnerabilities, maintain software supply chain security, and drive tracking to satisfy strict regulatory compliance frameworks. You will also serve as a technical responder during security incidents, deploying real-time countermeasures to protect our software ecosystem. What You'll Do Core Responsibilities Vulnerability Scanning & Triage: Perform periodic application security scanning activities. Review results and prioritize flaws based on CVSS scores, real-world exploitability, and system exposure. Compliance-Driven Tracking: Track, document, and manage vulnerabilities according to strict compliance SLAs (e.g., SOC 2, ISO 27001, PCI-DSS). Maintain audit-ready evidence of remediation timelines and exception approvals. Executive Reporting & Alerting: Escalate and report critical exposures directly to the CISO and senior leadership. Maintain dashboards and alerting mechanisms that visualize vulnerability status, risk trends, and compliance posture. Software Supply Chain Security: Ownership of the organization's Software Bill of Materials (SBOM). Continually update SBOM inventories to ensure compliance with modern regulatory requirements and dependency tracking. Help Replit mature through various SLSA levels for supply chain security. Remediation Collaboration: Partner with development teams to provide clear mitigation paths. Review, write, and patch code directly when necessary to resolve security flaws. Tooling Integration: Configure and tune automated security te

Job Summary The Mold Set Up Technician (hiring title: Manufacturing Engineer Technician I) is responsible for set up, heat up, start up, material handling, operating, quality control, troubleshooting, changeovers and adjusting process settings for plastic injection molding presses and related equipment per set up sheet in the plant. Ongoing training is required in this role and will include: Arburg machines, Wittmann central material preparation, optical measuring system, quality requirements, Hydra Software and other training as determined. Off-site training and travel may also be required on occasion. Responsibilities Responsible for set up, heat up, start up, operating, troubleshooting, and adjusting process settings for plastic injection molding presses and related equipment per set up sheet in the plant. Demonstrate problem solving and strong troubleshooting skills supporting injection molding process. Train and assist shift personnel, machine operator, etc. Assist maintenance with troubleshooting and equipment repair as directed. Provide analysis, spreadsheets related to molds and injection molding processes. Experience in mold care, repair, installation & removal of molds. Ability to perform cavity/core changeovers, maintenance of all mold tooling in the department. Perform preventive maintenance on molding equipment (hopper, dryer, TCU, conveyor) and molds. Ability to oversee, monitor and perform all operations for the entire plastics injection molding department on his/hers shift. Ensures safety and housekeeping standards are maintained. Works on and feel safe working on and handling tools up to 2 tons. Assists and trains others in job as needed. Responsible for area cleanliness and organization according to workplace standards. Performs related duties as assigned by supervisor. Follows procedures associated with ISO 9001, ISO 14001, and OSHAS 18001. Follows necessary PPE Requirements for a given work center. Qualifications Associate Degree

At Asana, security is foundational to our mission of helping teams work together effortlessly. Our security team protects Asana’s employees, users, and customers by proactively addressing threats, ensuring compliance with legal and regulatory requirements, and fostering a culture of security throughout our product and operations. We are a team of security engineers and risk and compliance practitioners who build innovative safeguards and collaborate across the organization to build and maintain trust at scale. As the Third Party Risk Management Lead, you will be responsible for building and running Asana’s Third Party Risk Management (TPRM) program. You will own the end-to-end lifecycle of vendor security risk — from initial due diligence and risk tiering through ongoing monitoring and remediation. You will work closely with Procurement, Legal, Privacy, and Engineering teams to ensure that our third-party relationships are effectively assessed, tracked, and managed. This role is based in our Vancouver office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do and the teams with which you partner. If you're interviewing for this role, your recruiter will share more about the in-office requirements. What you’ll achieve Own and scale Asana’s TPRM program: Design, implement, and continuously improve a risk-based framework for assessing and managing third-party vendors and service providers. Establish risk tiering criteria, assessment workflows, and governance processes that scale with business growth. Lead vendor security assessments: Conduct and oversee security due diligence for new and existing vendors, including reviewing SOC 2 reports, ISO 27001 certifications, security questionnaires (SIG, CAIQ), and other relevant documentation. Identify gaps and work with vendors to remediate findings. Dri

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the Role We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit’s cloud-native AI platform. You will own the lifecycle of security vulnerabilities affecting our products and services—from intake to validation, remediation coordination, and public disclosure. This role requires strong technical ability to reproduce vulnerabilities , deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs. You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly. What You’ll Do Vulnerability Intake, Triage & Validation Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels. Independently validate, reproduce, severity-score, and document findings. Identify duplicates and maintain a clean vulnerability records pipeline. Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC). Remediation Coordination & SLA Management Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation. Provide detailed reproduction steps, proof-of-concepts, and technical analyses. Track SLAs, remediation progress, regression testing, and systemic improvements. Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance. Bug Bounty & Vulnerability Disclosure Program Management Design and evolve the bug bounty program, including scope, rules, and reward structures. Man

About the Company: Nivagen is a global company dedicated to enhancing lives by developing and providing cost-effective generic prescription drugs and over-the-counter products for the North American market. For over a decade, we've remained steadfast in our commitment to core values of excellence, integrity, and respect for people. Our team of professionals collaborates tirelessly to pioneer advancements in manufacturing, distribution, and quality control, ensuring a holistic approach to healthcare. Through vertical integration of the pharmaceutical supply chain, cutting-edge technology, and unwavering dedication to excellence, we continually strive to redefine medication accessibility and affordability. We prioritize our employees' well-being by offering competitive pay, comprehensive benefits, and robust training and development opportunities. By investing in our workforce and fostering a culture of growth and support, we empower our team to drive innovation and make a positive impact in the healthcare industry. At Nivagen, our mission is clear: to make a meaningful difference in people's lives by delivering high-quality, affordable medications while upholding the highest standards of integrity and excellence. Job Location: Nivagen Pharmaceuticals LLC, Sacramento, CA 3900 Duckhorn Dr, Sacramento, CA 95834 About the Job: Title of the Position: Manufacturing Associate The Manufacturing Associate is responsible for executing aseptic and cleanroom manufacturing operations in compliance with cGMP, regulatory standards, and internal SOPs. This role plays a critical part in ensuring the integrity and quality of sterile drug products manufactured at Nivagen. The position requires a high degree of attention to detail, adherence to gowning and aseptic techniques, and the ability to follow precise procedures. Responsibilities: Operate in ISO environments performing essential duties to manufacturing sterile products. Installation, qualification of the Formulation, filtration,

ABOUT BASETEN Baseten powers mission-critical inference for the world's most dynamic AI companies, like Cursor, Notion, OpenEvidence, Abridge, Clay, Gamma, and Writer. By uniting applied AI research, flexible infrastructure, and seamless developer tooling, we enable companies operating at the frontier of AI to bring cutting-edge models into production. We're growing quickly and recently raised our $1.5B Series F , led by Altimeter Capital, Conviction Partners, and Spark Capital. Join us and help build the platform engineers turn to ship AI products. THE ROLE We are seeking an experienced and proactive Security Engineer to help us build, maintain, and continuously improve the security posture of our rapidly growing ML infrastructure platform. As one of the first dedicated security hires at Baseten, you will work cross-functionally with engineering and operations teams to ensure we’re meeting the highest standards of confidentiality, integrity, and availability. You’ll have an opportunity to shape our security strategy and best practices from the ground up, influencing the way our platform handles sensitive data for both internal and external stakeholders. RESPONSIBILITIES Security architecture and design: Collaborate with engineering teams to design and implement secure systems and infrastructure, including cloud (AWS/GCP) environments and container orchestration platforms. Vulnerability management: Lead proactive vulnerability assessments, pen tests, and remediation efforts to ensure our products and infrastructure remain secure. Incident response: Develop and maintain incident response processes, including detection, analysis, containment, eradication, and post-incident reviews. Identity and access management (IAM): Oversee IAM strategies and tools to ensure the right people have the right level of access to our systems and data. Security compliance and audits: Work closely with operations to ensure compliance with relevant standards (e.g., SOC 2, ISO 27001) and as

Tenstorrent is leading the industry on cutting-edge AI technology, revolutionizing performance expectations, ease of use, and cost efficiency. With AI redefining the computing paradigm, solutions must evolve to unify innovations in software models, compilers, platforms, networking, and semiconductors. Our diverse team of technologists have developed a high performance RISC-V CPU from scratch, and share a passion for AI and a deep desire to build the best AI platform possible. We value collaboration, curiosity, and a commitment to solving hard problems. We are growing our team and looking for contributors of all seniorities. The Architecture team at Tenstorrent is designing the central compute chiplet that powers our next generation automotive SoC. This role is about turning real world automotive and safety requirements into architecture that performs, scales, and ships fast and reliably. If you think silicon design should start with clarity and end with confidence, this is where your experience makes the biggest impact. This role is remote, based in Munich, Germany. We welcome candidates at various experience levels for this role. During the interview process, candidates will be assessed for the appropriate level, and offers will align with that level, which may differ from the one in this posting. Who You Are Approach design with a systems mindset, always thinking in trade offs, not just specs and block diagrams. Bring deep knowledge of SoC architecture, from interconnects and I/O to memory and CPUs. Confident working within performance, power, and reliability constraints. Familiar with, or eager to dive into, functional safety, ISO 26262, and automotive grade design challenges. What We Need Someone to architect and specify one or more chiplets in the robotics and automotive family. 5+ years of experience translating high level requirements into detailed architectural direction. Ability to identify impactful features that boost PPA, safety, and reliab