Commercial Compliance Lead

About Factory

Our mission is to create a world where software builds and improves itself.

We build the platform for self-improving software development, helping the world's largest enterprise engineering teams turn their organizations into autonomous software factories. Customers including Nvidia, Blackstone, Royal Bank of Canada (RBC), Palo Alto Networks, Adobe, and T-Mobile run Factory to ship code, review PRs, run tests, and deploy continuously - getting smarter with every cycle.

In 2026, we raised $200M at a $5B valuation, bringing our total funding to over $400M. We are backed by world-class investors and operators including Khosla Ventures, Sequoia, Blackstone, Ali Ghodsi (CEO of Databricks), and Frank Slootman (Former CEO of Snowflake).

About the Role

Factory is looking for a Commercial Compliance Lead to build and run our commercial compliance program from the ground up. As we sell to some of the most regulated enterprises in the world, across healthcare, financial services, insurance, and automotive, you will make sure every enterprise deal meets its regulatory, security, and contractual requirements while keeping deals moving. You will partner closely with our Enterprise sales team, Deal Desk, Legal, Engineering, and Security, and work alongside our Federal Compliance Lead, who owns public sector compliance. You will own the policies, processes, and guidance that let Factory sell to regulated industries with confidence. This is an individual contributor role on the Legal team.

What you will do and achieve

• Build Factory’s Commercial Compliance Architecture: Design, implement, and maintain the enterprise sales compliance program from the ground up, establishing policies, standard operating procedures, and monitoring mechanisms for deals in highly regulated industries like healthcare and finance.
• Accelerate Factory’s Enterprise Transactions: Partner directly with Enterprise Account Executives and Deal Desk from opportunity qualification through deal closure. Review customer security questionnaires (CAIQ, SIG), RFPs, and RFQs for compliance obligations, Business Associate Agreement (BAA) terms, and contractual risk.
• Meet Statutory and Regulatory Standards: Ensure comprehensive compliance with HIPAA/HITECH for healthcare verticals, the Digital Operational Resilience Act (DORA) for financial sectors, and overarching Information and Communication Technology (ICT) third-party risk management frameworks.
• Bridge Factory’s Product, Security, and Commercial Standards: Partner closely with Engineering and Security to align the product roadmap with enterprise certifications and regulatory requirements, including SOC 2 Type II, ISO/IEC 27001, NIST CSF, and DORA's technical resilience and incident reporting mandates.
• Govern Third-Party & Supply Chain Risk: Administer the company-wide vendor risk management program, managing ICT sub-outsourcing rights, subprocessor security assessments, continuous compliance monitoring, and audit rights for critical service providers.
• Monitor Emerging Commercial AI Policy: Track global AI governance directives (including the EU AI Act, NIST AI RMF, and industry-specific AI guidelines) and data privacy mandates, translating evolving policy into actionable operational guidance for commercial teams.
• Build Compliance Agents and Workflows: Automate as much of the day to day compliance work as possible to leverage your strategic insights

Qualifications

• Commercial Enterprise Expertise: 6+ years of hands-on experience in regulatory compliance, third-party risk management (TPRM), or commercial sales operations at an enterprise SaaS, cloud platform, or high-growth B2B technology company.
• Mastery of Commercial Regulations: Deep working knowledge of HIPAA/HITECH, EU DORA, ICT supply chain governance, and commercial contracting practices, including Data Processing Agreements (DPAs), BAAs, and specialized regulatory schedules.
• Cloud & AI Compliance Literacy: Proven track record operationalizing compliance frameworks for cloud software, including familiarity with SOC 2, ISO 27001 readiness, and modern compliance automation platforms.
• A Builder Mindset: You are excited to build a compliance program from scratch, comfortable operating in high-velocity, ambiguous environments, and proactive about finding scalable solutions that enable sales momentum.
• Crisp Cross-Functional Communication: Exceptional ability to synthesize dense regulatory requirements into clear guidance for sales executives, software engineers, corporate counsel, and enterprise CISOs or compliance officers.
• Professional Credentials: Holding active industry governance and privacy certifications such as CIPP/US, CIPP/E, CRISC, CISA, or HCISPP is highly preferred.

Location: Remote (US), with regular travel to Factory offices required.