Want to know if this job is worth applying to?
Remote or Hybrid UK
Remote only
Not Available
Trigger.dev is an open source platform used by developers to build production-grade AI agents. It's an SDK and the infrastructure to run agents reliably at scale, so teams can focus on the product instead of the plumbing.
Our Cloud product is a managed service where we deploy our users' code and auto-scale from zero to millions of executions. With the rise of AI, being able to offload async tasks reliably is a key part of any developer's toolkit: We're building the infrastructure to make that a reality.
We're looking for our first Compliance & Security Lead to own security compliance and data protection at Trigger.dev. You'll report to the founders, and work closely with engineering.
We already hold SOC 2 Type II, run our program through Oneleet, and publish a trust portal covering SOC 2, GDPR and HIPAA. Until now the founders and engineers have handled compliance alongside their day jobs. As we grow, customers send more security questionnaires, ask for more reports and negotiate more DPAs. Now we need somebody to own this, keep it running all year, and free our engineers to build.
You don’t need to be an engineer, but technical experience is a bonus. This role suits someone process-minded who likes making compliance practical, rather than just ticking boxes.
You'll do a variety of things including:
Running our SOC 2 and HIPAA programs: owning our SOC 2 audit, managing evidence collection in Oneleet and keeping us audit-ready all year
Using AI and automation to speed up compliance work, from drafting questionnaire answers to collecting evidence and reviewing policies
Completing security questionnaires and vendor assessments, sharing our reports and bridge letters, and keeping our trust portal current
Reviewing and negotiating DPAs with customers and suppliers, working with our lawyers, keeping our records of processing up to date and handling data subject requests under UK and EU GDPR
Writing and maintaining our security, privacy and data retention policies, and making sure retention periods are enforced
Reviewing new tools and sub-processors before we adopt them, and keeping our sub-processor list current
Deciding when we need new frameworks, such as ISO 27001 or ISO 42001 (the AI management standard), and leading the work to get there
Making compliance seamless for the team: onboarding training, simple processes and automated evidence collection wherever possible
Keeping our incident response and breach notification process ready, and testing it each year
You really need to have:
5+ years in security compliance, GRC or data protection, ideally at a SaaS or developer tools company
Experience at an early-stage startup as the first or only compliance hire, with full ownership
Hands-on experience running a SOC 2 audit, from evidence collection through to the final report
An up to date working knowledge of UK and EU GDPR, and experience reviewing or negotiating DPAs
Experience completing security questionnaires accurately and quickly
Clear, plain writing - you can turn a policy into something engineers will read
Enough technical understanding to talk to engineers about cloud infrastructure, access control and logging (you don't need to write code)
If you are remote you must be within CET to ET timezones (GMT+1:00 to GMT-5:00). We will arrange 3 in-person events throughout the year
You'll be an amazing fit if you:
Have experience with ISO 27001 or HIPAA
Have used a compliance automation platform such as Oneleet, Vanta or Drata
Hold a privacy or security certification, such as CIPP/E, CISA or CISSP
Use AI tools to speed up questionnaires, evidence review and policy work
Are based in the UK and able to join the team in London
We are a small team with a flat hierarchy
We encourage continuous learning and personal development
Everyone operates autonomously; we trust you to get the job done, but to also quickly raise your hand if you need help
We care about our customers and the open-source community
Being a start-up, the work is challenging and fast-paced, but we also understand the importance of taking time off to recharge
Our code is public, so anyone can see how we build and run our platform. We want our security and compliance to be just as open.
We publish our security reports and trust portal, so customers can check our work instead of taking our word for it.
Customers trust us with their code and data. We’re open about how we protect it.
Generous compensation and equity - We hire the best talent and pay to reflect that. We also offer equity as a way to ensure everyone is invested in the success of the company.
Async working - Need a heads-down day or meeting-free days to stay productive? No problem!
Home office - We will help provide equipment for a comfortable setup so you're as productive at home as you are in the office.
Health insurance - Private health insurance, with Vitality for our UK team.
Dog and cat friendly office - Our London office welcomes four-legged colleagues.
Generous vacation - We believe it's important to take time off. We encourage you to take your 25 days vacation excluding national holidays, plus sick leave and generous parental leave.
Training budget - An annual budget to contribute towards learning such as purchasing books, an Audible subscription or online courses.
Pension contributions - Enroll in our company pension scheme or we'll contribute directly to your private pension.
