Role Overview
The Compliance Specialist is responsible for building and maintaining Inventeer’s compliance readiness system: policies, control documentation, evidence processes, and ongoing governance that makes audits and enterprise security requirements manageable and repeatable. This is a systems role. Success is measured by audit readiness with minimal disruption, clean evidence trails, clear ownership of controls, and repeatable compliance operations—not by writing policies that nobody follows. The Compliance Specialist partners with Engineering, DevOps, and Leadership to operationalize controls in a lightweight, enforceable way.
Key Responsibilities
Compliance Program & Control System
- Define and maintain compliance scope, control objectives, and control ownership across teams.
- Build and maintain a compliance calendar: recurring reviews, access audits, evidence cycles, and key control checks.
- Translate control requirements into practical workflows that fit how Inventeer delivers software.
Policies, Standards & Documentation
- Draft, maintain, and socialize core policies (security, access control, change management, incident response, vendor management, etc.).
- Ensure policies map to real implementation and evidence (no “shelfware”).
- Maintain a clear system of record: control narratives, process docs, and responsibility assignments.
Evidence Collection & Audit Support
- Define and run evidence collection processes (automated where possible): access reviews, change approvals, incident logs, training records, vendor artifacts.
- Prepare audit packages and support audit requests with fast, accurate responses.
- Coordinate with Engineering/DevOps to close control gaps and document remediation.
Vendor & Third-Party Risk
- Maintain vendor inventory and risk classification.
- Coordinate security questionnaires and artifact collection with vendors when required.
- Ensure vendor controls align with Inventeer’s risk posture and compliance commitments.
Risk Management & Continuous Improvement
- Maintain a risk register with clear mitigation plans and owners.
- Track compliance findings and ensure they result in implemented improvements (controls, automation, training).
Required Technical Skills
- Practical experience supporting compliance programs (SOC 2 / ISO 27001 / similar), evidence workflows, and audits.
- Strong documentation skills: can create clear, usable policies and control narratives.
- Experience defining control ownership, running recurring reviews, and keeping evidence trails clean.
- Strong project coordination skills across technical teams and stakeholders.
- Comfort working with engineering concepts (access control, deployments, logging) to collect the right evidence.
- Strong communication and organization: keeps compliance lightweight, consistent, and enforceable.
Nice to Have
- Experience with compliance tooling (Vanta/Drata/Secureframe or equivalents) and evidence automation.
- Experience with privacy requirements (data retention, data handling, customer requests) where applicable.
- Experience building compliance programs from early stage to “audit-ready.”
- Experience with customer security reviews and enterprise procurement requirements.
Behavioral Expectations
- Systems mindset: builds repeatable compliance operations, not one-off document pushes.
- Pragmatic governance: reduces risk without creating bureaucracy.
- Evidence discipline: treats compliance like production—clean trails, clear owners, reliable cadence.
- Collaboration: partners with Engineering/DevOps instead of policing them.
- Ownership: drives gaps to closure and ensures controls stay alive over time.