Senior Compliance Engineer

About Hevo:

Hevo is a fully-managed, no-code data pipeline platform that helps organizations move, transform, and activate their data in real time. With 150+ pre-built, battle-tested connectors, Hevo lets data teams focus on insights instead of pipeline maintenance — trusted by 2,000+ organizations globally to keep their data flowing reliably, securely, and in compliance with standards like SOC 2, GDPR, CCPA, DORA and HIPAA.

About the Role:

As Hevo's enterprise customer base grows, security and compliance reviews are an increasingly visible part of how deals get done. We're looking for a Senior Compliance Engineer to own our GRC program end-to-end — audits, risk, vendor management, and policy — and to be the technical face of security and compliance to customers and prospects during due diligence. Strong communication is essential: this role is regularly customer-facing and needs to translate technical detail into language that builds trust.

What You'll Do:

• Own and operate our compliance programs (SOC 2, GDPR, HIPAA, DORA, DPDP as applicable) end-to-end — control implementation, evidence collection, and audit management
• Be the primary point of contact for external auditors; manage audit timelines and evidence collection
• Own the risk assessment program — identify, assess, score, track, and report risks via a risk register
• Manage vendor and third-party risk assessments and due diligence
• Respond to customer and prospect security questionnaires (RFPs, due-diligence requests, trust-portal access) with accuracy and speed — a high-visibility, customer-facing part of this role
• Support Sales and Customer Success on security & compliance calls with prospects and customers, translating technical controls into business language
• Draft, maintain, and drive review of security policies and procedures
• Track and report on compliance posture and drift to leadership
• Partner with engineering and security teams to close compliance gaps pragmatically, balancing rigor with velocity
• Use GRC tooling (e.g., Sprinto, Vanta, Drata, or similar) to automate evidence collection and monitoring

What We're Looking For — Must-Haves:

• 4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)
• Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end
• Strong understanding of data protection & privacy — GDPR, HIPAA, PII/PHI handling
• Proven ability to manage vendor/third-party risk assessments
• Excellent written and verbal communication — comfortable presenting to and negotiating with external customers, auditors, and executives
• Experience responding to customer security questionnaires / RFPs
• Working knowledge of cloud environments (AWS) — enough to assess and discuss controls with engineering
• Strong organizational skills — able to manage multiple audits and timelines independently

Nice to Have:

• Experience with GRC automation platforms (Sprinto, Vanta, Drata, OneTrust)
• Relevant certifications (CISA, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP)
• Experience in a B2B SaaS company handling enterprise customer data