Compliance Manager

## About Coval Coval is the evaluation platform for enterprise voice AI, built by former Waymo engineers applying autonomous vehicle testing standards to help companies deploy and scale conversational agents to 10s of millions of calls a month. The platform gives engineering, product, QA, and operations teams the infrastructure to stress-test agents across millions of realistic scenarios before launch, monitor every live conversation in production, and continuously sharpen performance through human-in-the-loop review. Trusted by more than 60 customers like Chime and Zoom, Coval is the operations layer for voice interfaces. ## The role We're looking for a Compliance Manager to own security and compliance at Coval end to end. Our customers are enterprises in healthcare, fintech, and insurance, so trust is part of the product: every deal runs through a security review, and every new framework we hold opens another set of doors. We already hold SOC 2 and HIPAA, and PCI DSS and ISO 27001 are in process. You will own all of them, plus the audits and the procurement questionnaires and security reviews that come with enterprise sales. You'll be the person who keeps the whole program moving. Our compliance platform surfaces a steady stream of alerts and findings, and today they land on engineers who should be doing deeper security and product work. You'll take that load: triage every flag, fix the ones you can handle yourself, and hand the rest to the right engineer with clear context so it gets done. You'll be technical enough to make real changes and to know when something needs an engineer, and organized enough to run several audits and a steady flow of customer requests without anything slipping. ## What you'll do **Own our compliance frameworks** * Own the SOC 2 and HIPAA programs day to day, and drive PCI DSS and ISO 27001 from in-process to certified. * Keep policies, procedures, and the risk register accurate to how we actually operate, and make sure the controls our platform maps across frameworks are actually implemented and evidenced. * Take on new frameworks as customer demand grows (for example ISO 42001 or other AI-specific standards), with a clear view of which ones are worth the investment.  **Run audits to successful outcomes** * Manage auditors, assessors, and the audit calendar for every framework: scoping, readiness, fieldwork, and remediation. * Keep the program audit-ready year round instead of scrambling at fieldwork, with controls tested continuously and gaps tracked to closure.  **Manage our compliance platform and the alerts it raises** * Own our compliance platform (Oneleet) and triage every alert and failing control, deciding what's urgent, what's noise, and what needs a change. * Fix what you can directly: access and identity settings, device and policy gaps, vendor and HR items, documentation, and straightforward cloud or configuration changes. * For anything that needs deeper engineering or security work, write a clear Linear ticket with the control, the risk, and the evidence needed, route it to the right engineer, and follow it to closure. * Collect and organize audit evidence, and automate the repetitive pieces, such as access reviews and vendor reviews, with the platform and simple scripts where it makes sense.  **Own security reviews and procurement questionnaires** * Own the intake and turnaround of customer security questionnaires, security reviews, and vendor risk assessments, working with Sales so they don't stall deals. * Maintain our compliance knowledge base and answer library so responses are accurate, consistent, and quick, and pull in engineers only for questions that truly need them. * Join customer security calls when a prospect's team wants to go deeper, and feed recurring customer asks back into which controls, frameworks, and documents we prioritize next.  **Work across the company** * Partner with Engineering, Product, People, and Legal to implement controls that are minimally disruptive and sustainable as we scale, and manage the vendor risk process for the tools we use. ## What you'll need * 4+ years in compliance, GRC, security operations, or IT, including ownership of a third-party audit cycle end to end for at least one of SOC 2, ISO 27001, HIPAA, or PCI DSS. * Technical comfort: you can work in a cloud console (AWS or GCP), identity and device management tools, and ticketing systems, and you can read scripts or write simple ones. You don't need to be a software engineer, but you need to be able to tell a quick fix from one that needs an engineer. * Experience running a compliance automation platform (Oneleet, Vanta, Drata, or similar) and working through its findings. * Experience answering enterprise security questionnaires and supporting security reviews for a B2B SaaS company. * Strong project management: you can run several audits and a steady flow of customer requests at once, keep engineers moving on remediation, and follow things through to closure. * You communicate clearly with engineers, executives, auditors, and customers, and can explain a technical or compliance concept to a non-technical reader. * Strong attention to detail, and good judgment about risk: you know which gaps matter and which ones are noise. * Comfort with ambiguity at an early-stage company where the role isn't fully defined yet, because part of the job is defining it. ## Nice to have * Experience with PCI DSS or ISO 27001 certification specifically. * An engineering, DevOps, or security background, or experience in a hands-on security operations role. * Experience with AI-specific frameworks such as ISO 42001, NIST AI RMF, or the EU AI Act. * Experience in healthcare, fintech, or other regulated industries. * Experience at an early-stage startup, ideally as the first compliance hire. * Relevant certifications (CISSP, CISA, CISM, ISO 27001 Lead Implementer or Lead Auditor). ## Compensation & details * Salary: $100k-$150K + equity * Location: San Francisco office, 5 days a week ## Benefits * Healthcare, Dental, & Vision coverage * 401K * Pet friendly-office * Free gym membership * Free lunch and dinner when working in the office * Unlimited PTO Visa sponsorship is not available for this role.