The opportunity
The Compliance team at MongoDB manages the strategy, execution, and maintenance of our global security certifications and regulatory requirements. We ensure that our cloud database products meet the rigorous security standards required by our customers in the most highly regulated industries worldwide.
What you'll do
Lead the end-to-end execution of specialized external audits (e.g., PCI,: SOC2, ENS High, IRAP, ISO 22301) and coordinate all phases from initial scoping to final certification
Serve as the lead point of contact for Financial Services customer audits,: facilitating meetings, responding to security questionnaires, and defending our control environment to external stakeholders
Lead internal audit cadences and drive the POA&M tracking process, ensuring: technical teams remediate findings within required SLAs
Map new regulatory requirements to our central control framework, performing: gap analyses to identify where existing controls can be leveraged for new certifications
Conduct NIST CSF or similar maturity assessments to monitor the effectiveness: of the Compliance Program and report findings to team leads
Author and review customer-facing security documentation, ensuring it: accurately reflects our technical controls and architectural guardrails
What they're looking for
- + years in GRC, Information Security, or IT Audit, specifically within a high-growth SaaS/Cloud environment
- Deep understanding of cloud security principles (AWS/GCP/Azure) and a proven: track record leading technical audits for ISO 27001, SOC 2, or PCI
- Solid grasp of audit processes, terminology, and risk assessment standards.: Certifications such as CISA, CRISC, CISSP, or ISO Lead Implementer are highly preferred
- Exceptional ability to lead meetings with external customers and auditors,: translating technical complexities into business risk and compliance assurance
- Advanced proficiency in Jira for tracking control performance data and: managing high-volume remediation workflows
- Practical experience performing gap analyses and maturity assessments at an enterprise level
