Note: The job is a remote job and is open to candidates in USA. Snorkel helps enterprises transform expert knowledge into specialized AI at scale, enabling organizations to build custom AI with their data. The Technical Compliance Analyst will operate the Trust & Security program by maintaining SOC 2 compliance, supporting audit cycles, embedding compliance into engineering workflows, automating controls, and preparing the organization for federal standards such as CMMC and FedRAMP.
Responsibilities
- Help drafting accurate, technically precise responses to RFPs, security questionnaires (CAIQ, SIG, custom risk assessments), and customer portals
- Own and continuously update the "Library of Truth"—a pristine repository of pre-vetted security evidence, technical configurations, and policy documents. By keeping this repository audit-ready, you enable the Security team to respond to enterprise prospects in hours, not days
- When a customer asks about AWS KMS encryption, logging pipelines, or IAM privilege escalation paths, you retrieve the granular evidence and draft the written narrative the Security and Legal Team needs to confidently close the deal
- Partner with IT, Security, Product, Engineering, and Delivery early in the development lifecycle. Review new features, infrastructure changes, and vendor integrations to influence architectural decisions that bake in compliance by design—without creating friction or slowing sprints
- Write, update, and operationalize security policies that accelerate delivery. Translate abstract SOC 2 and NIST controls into clear, developer-friendly tasks (e.g., IAM hardening, log retention, Zero Trust implementation)
- Where possible, automate policy enforcement in CI/CD pipelines so that security checks are invisible, automated, and frictionless for engineering teams
- Conduct lightweight compliance enablement sessions with engineering teams—showing them how to self-serve evidence collection and interpret compliance requirements—so security becomes everyone's responsibility, not just yours
- Drive and coordinate the end-to-end SOC 2 Type I and Type II audit cycles across our business entities. Manage audit schedules, coordinate with external auditors, and drive remediation of findings to keep us perpetually audit-ready
- Be the power-user of our modern GRC stack (Vanta, Drata). Automate evidence collection, continuously monitor technical controls, and eliminate manual spreadsheet tracking
- Manage the compliance ticketing queue in Jira. Execute routine mandates including quarterly User Access Reviews (UAR), security awareness training, phishing simulations, and managing the Risk Acceptance/Exception process
- Build and maintain compliance dashboards (KPIs/KRIs) for the Security Lead and executive team. Track audit readiness scores, remediation SLAs, and control health trends to provide clear visibility into our posture
- Manage the annual policy review and attestation cycle—ensuring process owners review, sign off, and update documentation on schedule, keeping our policies evergreen
- Assist the Security Team in aligning current controls with federal standards—specifically NIST SP 800-53, NIST SP 800-171 Rev 3, FedRAMP, and CMMC 2.0. Help draft early System Security Plans (SSPs) and Plan of Action & Milestones (POA&Ms)
- Own the third-party vendor review process, assessing critical partners (Cloud, HRIS, CRM) to meet strict federal supply chain requirements and offload this operational work from the Security Lead
- Support the Security Team during security incidents by preserving audit-relevant evidence, documenting the chronology of events, and drafting post-incident reports to satisfy regulatory and audit requirements
Skills
- 2–5 years of experience in technical compliance, IT audit, or GRC within a SaaS or fast-paced startup environment
- Proven end-to-end experience supporting external SOC 2 Type I and Type II audits—with specific expertise auditing IT General Controls (ITGC) (Change Management, Logical Access, System Operations)
- You know how to manage auditors and translate their requests into actionable developer tasks
- Strong understanding of modern cloud infrastructure (AWS/GCP/Azure), IAM, CI/CD pipelines, encryption standards, and vulnerability management
- You can read a Terraform plan or an AWS Config rule and interpret its compliance impact
- Experience operating automated compliance platforms (Vanta, Drata), tracking work in Jira, and security awareness platform (KnowBe4)
- You are a business enabler
- You practice "Yes, if..." security—you negotiate secure alternatives rather than blocking releases or ignoring risks
- You thrive in a partnership role, ensuring IT, Security, Engineering, and Delivery teams have everything they need to succeed
- Exceptional written and verbal communication skills with the ability to explain technical controls to customers and business risks to engineers
Benefits
- Meaningful opportunities to shape priorities and initiatives, influence key strategic decisions, and directly impact our ongoing success.
- Opportunities to deepen your technical expertise and explore leadership opportunities.
- Opportunities to learn new skills across multiple functions.
- Full support in building your career in an environment designed for growth, learning, and shared success.
- Modern, automated GRC tooling that reduces manual spreadsheet tracking and enables focus on technical risk and architecture.
Company Overview