Security & Compliance Lead

Own Dipp AI's security posture and the compliance evidence enterprises demand before deployment.

Enterprises will not route consequential actions through a control plane they cannot verify. You will own the programme that makes Dipp AI verifiable: internal security, certification, customer assurance, and the regulatory mapping behind our claims.

That includes running SOC 2 and ISO 27001, preparing for HIPAA and sector-specific obligations, mapping product behaviour to the EU AI Act, and being the person in the room when a CISO tests our architecture.

You will also work inside the product, because most of our compliance story is enforced in code rather than in policy documents.

• Own the security programme: policies, controls, vulnerability management, and incident response.
• Drive SOC 2 Type II, ISO 27001, and subsequent certifications end to end.
• Map Orcher behaviour to regulatory regimes and keep the mapping accurate as the product changes.
• Lead customer security reviews, questionnaires, and penetration-test coordination.
• Work with engineering to enforce controls in code rather than in documentation.
• Own vendor risk, access review, and the internal control cadence.

• Experience running security and compliance at a company selling into regulated enterprises.
• Hands-on certification experience — you have carried an audit, not just observed one.
• Technical depth sufficient to challenge an engineering design.
• Knowledge of AI-specific regulatory developments, including the EU AI Act.
• Excellent written communication for auditors, customers, and engineers.
• Pragmatism about which controls matter at this stage.

• 8+ years in security, GRC, or compliance engineering, with 3+ years in a leadership role.
• Has taken an organisation through at least one successful SOC 2 Type II or ISO 27001 audit.
• Experience with financial services, healthcare, or public-sector procurement is a strong plus.

• BS or MS in Computer Science, Information Security, Law, or a related field.
• CISSP, CISA, CISM, or equivalent certification is welcome but not required.

• Equity with a standard four-year vest.
• Full medical, dental, and vision coverage.
• 401(k) with company contribution and a certification budget.
• Annual conference and learning budget.