Senior Compliance Engineer

About the Role

As Hevo's enterprise customer base grows, security and compliance reviews are an increasingly visible part of how deals get done. We're looking for a Senior Compliance Engineer to own our GRC program end-to-end — audits, risk, vendor management, and policy — and to be the technical face of security and compliance to customers and prospects during due diligence. Strong communication is essential: this role is regularly customer-facing and needs to translate technical detail into language that builds trust.

What You'll Do

• Own and operate our compliance programs (SOC 2, GDPR, HIPAA, DORA, DPDP as applicable) end-to-end — control implementation, evidence collection, and audit management

• Be the primary point of contact for external auditors; manage audit timelines and evidence collection

• Own the risk assessment program — identify, assess, score, track, and report risks via a risk register

• Manage vendor and third-party risk assessments and due diligence

• Respond to customer and prospect security questionnaires (RFPs, due-diligence requests, trust-portal access) with accuracy and speed — a high-visibility, customer-facing part of this role

• Support Sales and Customer Success on security & compliance calls with prospects and customers, translating technical controls into business language

• Draft, maintain, and drive review of security policies and procedures

• Track and report on compliance posture and drift to leadership

• Partner with engineering and security teams to close compliance gaps pragmatically, balancing rigor with velocity

• Use GRC tooling (e.g., Sprinto, Vanta, Drata, or similar) to automate evidence collection and monitoring

What We're Looking For — Must-Haves

4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)

Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end

Strong understanding of data protection & privacy — GDPR, HIPAA, PII/PHI handling

Proven ability to manage vendor/third-party risk assessments

Excellent written and verbal communication — comfortable presenting to and negotiating with external customers, auditors, and executives

Experience responding to customer security questionnaires / RFPs

Working knowledge of cloud environments (AWS) — enough to assess and discuss controls with engineering

Strong organizational skills — able to manage multiple audits and timelines independently

Nice to Have

Experience with GRC automation platforms (Sprinto, Vanta, Drata, OneTrust)

Relevant certifications (CISA, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP)

Experience in a B2B SaaS company handling enterprise customer data