Compliance Manager [IC3]

<div class="content-intro"><h2><span style="color: rgb(243, 78, 63);">Who we are</span></h2>
<p>Our mission is to bring clarity and control to the world's most complex codebases. AI is accelerating code creation, but the infrastructure to understand, oversee, and evolve that code hasn't kept pace. Sourcegraph gives engineering organizations full visibility across their systems, precise context for their agents, and the ability to execute coordinated code changes at scale. As agentic development becomes the dominant engineering paradigm, we provide the context layer teams need to take control of their codebase.<br><br>With Code Search, Deep Search, MCP, and Agentic Batch Changes, we deliver on that mission today - giving engineering teams and their AI tools the cross-repo context to navigate massive codebases with confidence, and the ability to make changes across hundreds of repositories at once.<br><br>Companies like Stripe, Reddit, and Leidos rely on Sourcegraph to ship faster and with higher quality. We're backed by a16z, Sequoia, and Redpoint, and proud to operate as a globally distributed team that values high agency, direct communication, and customer love.<br><br>If you want to build the infrastructure that lets every engineering team - and every agent they deploy - operate on their codebase with confidence, join us.</p></div><h2><span style="color: rgb(243, 78, 63);"><strong>Hours &amp; location</strong></span></h2>
<p>🌎 While we hire <a href="https://sourcegraph.notion.site/How-we-engage-talent-outside-of-the-US-218f7193695a46cbb1ef39ef9c1f72d4">almost anywhere</a> in the world, we have a preference for someone to reside in the following locations for this role. However, if you feel qualified, we welcome you to apply regardless of location. No matter what, working hours must overlap with GMT-3 for at least 20 hours/week.</p>
<p><strong>Preferred locations:</strong></p>
<ul>
<li>USA</li>
</ul>
<h2><span style="color: rgb(243, 78, 63);"><strong>Why this job is exciting</strong></span></h2>
<p>As our Compliance Manager, you will own and drive Sourcegraph’s governance, risk, and compliance program, with a primary focus on compliance. This is a highly cross-functional role that works closely with Security, Engineering, IT, Legal, People, Sales, and other teams across the company.&nbsp;</p>
<p>You will be responsible for maintaining and evolving our compliance program, including owning certifications such as SOC 2 and ISO 27001 and preparing Sourcegraph for additional frameworks as the business grows. This is not a role where you will simply coordinate work across a large compliance organization. We are looking for someone who has personally owned audit and certification programs end to end: designing and tailoring controls, collecting evidence, training internal teams, working directly with auditors, managing remediation, and driving follow-up work through completion.</p>
<p>📅 Within one month, you will…</p>
<ul>
<li>You will build strong working relationships across Security, Engineering, IT, Legal, People, Sales, and other key stakeholders.</li>
<li>You will develop a clear understanding of Sourcegraph’s existing governance, risk, and compliance program, including our ISMS, risk register, controls, certifications, audit processes, and current areas of focus.</li>
<li>You will understand how our SOC 2 and ISO 27001 programs operate today, including key owners, evidence requirements, open risks, and upcoming milestones.</li>
<li>You will begin participating directly in day-to-day compliance activities and identify opportunities to improve or simplify existing processes.</li>
</ul>
<p>📅 Within three months, you will…</p>
<ul>
<li>You will have taken ownership of Sourcegraph’s ongoing SOC 2 and ISO 27001 compliance programs.</li>
<li>You will independently manage key audit activities, including control testing, evidence collection, stakeholder coordination, auditor requests, findings, and remediation.</li>
<li>You will evaluate existing controls and tailor them to Sourcegraph’s environment rather than relying on overly prescriptive or generic auditor recommendations.</li>
<li>You will actively maintain Sourcegraph’s risk register, ISMS processes, policies, and compliance documentation.</li>
<li>You will help internal teams understand their compliance responsibilities and provide practical guidance that allows them to meet requirements without creating unnecessary process.</li>
<li>You will support customer-facing compliance activities, including security questionnaires and compliance-related questions from prospective and existing customers.</li>
</ul>
<p>📅 Within six months, you will…</p>
<ul>
<li>You will have successfully led Sourcegraph through an audit or major certification milestone.</li>
<li>You will own the operating rhythm of the GRC program, including ISMS meetings, risk management activities, control reviews, documentation updates, and audit preparation.</li>
<li>You will have established a fo