Compliance & Security Lead

About Trigger.dev

Trigger.dev is an open source platform used by developers to build production-grade AI agents. It's an SDK and the infrastructure to run agents reliably at scale, so teams can focus on the product instead of the plumbing.

Our Cloud product is a managed service where we deploy our users' code and auto-scale from zero to millions of executions. With the rise of AI, being able to offload async tasks reliably is a key part of any developer's toolkit: We're building the infrastructure to make that a reality.

About the position

We're looking for our first Compliance & Security Lead to own security compliance and data protection at Trigger.dev. You'll report to the founders, and work closely with engineering.

We already hold SOC 2 Type II, run our program through Oneleet, and publish a trust portal covering SOC 2, GDPR and HIPAA. Until now the founders and engineers have handled compliance alongside their day jobs. As we grow, customers send more security questionnaires, ask for more reports and negotiate more DPAs. Now we need somebody to own this, keep it running all year, and free our engineers to build.

You don’t need to be an engineer, but technical experience is a bonus. This role suits someone process-minded who likes making compliance practical, rather than just ticking boxes.

You'll do a variety of things including

• Running our SOC 2 and HIPAA programs: owning our SOC 2 audit, managing evidence collection in Oneleet and keeping us audit-ready all year
• Using AI and automation to speed up compliance work, from drafting questionnaire answers to collecting evidence and reviewing policies
• Completing security questionnaires and vendor assessments, sharing our reports and bridge letters, and keeping our trust portal current
• Reviewing and negotiating DPAs with customers and suppliers, working with our lawyers, keeping our records of processing up to date and handling data subject requests under UK and EU GDPR
• Writing and maintaining our security, privacy and data retention policies, and making sure retention periods are enforced
• Reviewing new tools and sub-processors before we adopt them, and keeping our sub-processor list current
• Deciding when we need new frameworks, such as ISO 27001 or ISO 42001 (the AI management standard), and leading the work to get there
• Making compliance seamless for the team: onboarding training, simple processes and automated evidence collection wherever possible
• Keeping our incident response and breach notification process ready, and testing it each year

You really need to have

• 5+ years in security compliance, GRC or data protection, ideally at a SaaS or developer tools company
• Experience at an early-stage startup as the first or only compliance hire, with full ownership
• Hands-on experience running a SOC 2 audit, from evidence collection through to the final report
• An up to date working knowledge of UK and EU GDPR, and experience reviewing or negotiating DPAs
• Experience completing security questionnaires accurately and quickly
• Clear, plain writing - you can turn a policy into something engineers will read
• Enough technical understanding to talk to engineers about cloud infrastructure, access control and logging (you don't need to write code)
• If you are remote you must be within CET to ET timezones (GMT+1:00 to GMT-5:00). We will arrange 3 in-person events throughout the year

You'll be an amazing fit if you

• Have experience with ISO 27001 or HIPAA
• Have used a compliance automation platform such as Oneleet, Vanta or Drata
• Hold a privacy or security certification, such as CIPP/E, CISA or CISSP
• Use AI tools to speed up questionnaires, evidence review and policy work
• Are based in the UK and able to join the team in London

About the team

• We are a small team with a flat hierarchy
• We encourage continuous learning and personal development
• Everyone operates autonomously; we trust you to get the job done, but to also quickly raise your hand if you need help
• We care about our customers and the open-source community
• Being a start-up, the work is challenging and fast-paced, but we also understand the importance of taking time off to recharge

Working at a Commercial Open Source Software company is more than just your day job

• Our code is public, so anyone can see how we build and run our platform. We want our security and compliance to be just as open.
• We publish our security reports and trust portal, so customers can check our work instead of taking our word for it.
• Customers trust us with their code and data. We’re open about how we protect it.

Benefits

• Generous compensation and equity - We hire the best talent and pay to reflect that. We also offer equity as a way to ensure everyone is invested in the success of the company.
• Async working - Need a heads-down day or meeting-free days to stay productive? No problem!
• Home office - We will help provide equipment for a comfortable setup so you're as productive at home as you are in the office.
• Health insurance - Private health insurance, with Vitality for our UK team.
• Dog and cat friendly office - Our London office welcomes four-legged colleagues.
• Generous vacation - We believe it's important to take time off. We encourage you to take your 25 days vacation excluding national holidays, plus sick leave and generous parental leave.
• Training budget - An annual budget to contribute towards learning such as purchasing books, an Audible subscription or online courses.
• Pension contributions - Enroll in our company pension scheme or we'll contribute directly to your private pension.

Where you can be based

This position is 100% remote and open to applicants based in United Kingdom.