Compliance Lead - Soda

About Soda

At Soda, we're on a mission to bring everyone closer to their data. We believe that all data stakeholders (and we think that's everyone) should be able to understand it, trust it, and stay on top of it. We're pioneering the fastest-growing category in the data and analytics space, known as data quality and observability. We allow teams to discover, prioritize, and collaboratively resolve data issues. Our integrated platform brings everyone closer to the data, resulting in data products and analytics everyone can trust.

We are an international team, headquartered in Brussels, Belgium and dispersed globally. Our customers are enterprises (banks, insurers, retailers, and utilities), so security compliance isn't paperwork for us. It's part of how we win deals and keep them.

The Job

We're looking for someone to own Soda's compliance function and keep building it. We've already built a strong foundation: we've been running a SOC 2 cycle since 2021, and have been making strides in automating and professionalizing the entire compliance process in the past year. But we aren't where we want to be yet. You will be pushing this further: maximizing automation and streamlining processes, so we get even better compliance, while minimizing time our engineers and ops team have to spend on manual execution and evidence gathering.

Soda's product and operations are evolving at lightning speed. You will be the person to find pragmatic ways to make sure we keep our compliance commitments without slowing us down.

If your instinct when you see a manual process is to ask what should be doing this instead of a person, this is a good role for you.

What You'll Do

Build the structure (roughly half of the job):

• Push the automation of our compliance program as far as it can go.
• Adapt our compliance posture to fast-paced AI developments and changes.
• Make RFP and security-questionnaire responses hyper-efficient using existing tooling.

Keep it running (the other half of the job):

• Own the annual SOC 2 Type II and SOC 3 cycle with our external auditor.
• Keep the control set audit-ready all year round.
• Run people compliance (onboarding/offboarding compliance steps, security training, code of conduct, incident reporting, phishing cycles).
• Partner with Sales on enterprise security reviews to unblock deals.

Requirements

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company.
• Hands-on experience running a SOC 2 Type II cycle directly with external auditors through scoping, sampling, and remediation.
• Hands-on experience with compliance automation platforms (Drata ideally, or Vanta / Secureframe).
• Comfortable designing and implementing automations, including with AI tools.
• Familiarity with core infrastructure systems: AWS, Okta, GitHub, endpoint management.
• Comfortable answering enterprise security questionnaires and speaking with prospective enterprise buyers.
• Clear written and spoken English with strong policy-writing judgment.
• Available roughly 2–3 days per week, with solid working-hours overlap with CET.
• Must be working in an EU time zone.
• Able to invoice as a freelancer / contractor.

Nice to Have

• Technical background or hands-on engineering experience.
• Experience working in a company with under 200 people.
• ISO 27001 experience.
• Certifications such as CISA, CISM, CIPP/E, or ISO 27001 Lead Implementer.

Benefits & Role Highlights

• Real mandate to build a modern, AI-forward compliance program.
• Live, certified programme with full freedom to implement improvements.
• Complete runbooks, scheduling systems, and written handover available from day one.
• Direct access to key decision-makers with minimal hierarchy.
• Competitive contractor rate.