Why this role
Most compliance work is still screenshots, spreadsheets and evidence chased by hand before every audit. AI changes that: evidence can be gathered from the real state of a cloud environment, continuously, by agents.
You'll build those agents. First, to run Defendermate's own compliance program. Then for the cloud security and compliance professionals who need them but don't have them yet.
What you'll build
- Agents that keep Defendermate compliant: SOC 2 Type 2 and ISO 27001 evidence collected from our real systems, access reviews, joiner and leaver checks, and gaps flagged as they appear rather than before an audit. We're your first customer and your proving ground.
- Agents for the profession: mapping controls (SOC 2, ISO 27001, PCI DSS and others) to the verified security state of a customer's environment, and producing evidence an auditor will accept.
- A trust library that answers itself: accurate, evidence-backed answers to security questionnaires and customer reviews.
What you'll do
- Own our SOC 2 Type 2 and ISO 27001 program end to end, working with our compliance platform (Sprinto).
- Run internal security operations: access reviews, onboarding and offboarding, cloud account hygiene, penetration-test follow-through.
- Answer security questionnaires and customer security reviews, and keep the answers current.
- Own the compliance side of changes our product makes in customer environments: approvals, change records and audit evidence.
- Automate everything that repeats.
Your first year
- First 90 days: you own our SOC 2 Type 2 controls end to end, the questionnaire library is current, and access reviews and offboarding run on schedule.
- First year: our Type 2 report is issued, ISO 27001 is maintained, and the first compliance agents are in use, on us and with customers.
You might be a fit if
- You've owned SOC 2 or ISO 27001 controls hands-on, not only supported audits.
- You've worked with a compliance automation platform (Sprinto, Drata, Vanta or similar).
- You know AWS security fundamentals: IAM, logging, configuration hygiene.
- You script in Python to automate evidence and checks, and use AI tools heavily.
- Your writing is precise: questionnaire answers have to be right.
Bonus points: PCI DSS, HIPAA or India's DPDP Act; compliance tooling built as a product feature; security engineering beyond GRC.