Compliance Lead (part-time, contractor)

About Soda

At Soda, we're on a mission to bring everyone closer to their data. We believe that all data stakeholders (and we think that's everyone) should be able to understand it, trust it, and stay on top of it. We're pioneering the fastest-growing category in the data and analytics space, known as data quality and observability. We allow teams to discover, prioritize, and collaboratively resolve data issues. Our integrated platform brings everyone closer to the data, resulting in data products and analytics everyone can trust.

We are an international team, headquartered in Brussels, Belgium and dispersed globally. Our customers are enterprises (banks, insurers, retailers and utilities), so security compliance isn't paperwork for us. It's part of how we win deals and keep them.

The job

We're looking for someone to own Soda's compliance function and keep building it. We've already built a strong foundation: we've been running a SOC 2 cycle since 2021, and have been making strides in automating and professionalizing the entire compliance process in the past year. But we aren't where we want to be yet. You will be pushing this further: maximizing automation and streamlining processes, so we get even better compliance, while minimizing time our engineers and ops team have to spend on manual execution and evidence gathering.

Soda's product and operations are evolving at lightning speed. You will be the person to find pragmatic ways to make sure we keep our compliance commitments without slowing us down.

If your instinct when you see a manual process is to ask what should be doing this instead of a person, this is a good role for you.

What you'll do

Build the structure. Roughly half of this job is making compliance at Soda easier and more reliable to run:

• Push the automation of our compliance program as far as it can go. We've already got a compliance automation platform, lots of controls are already fully or partially automated. Your job is to take that even further. Every minute you give back to our engineers by taking away manual tasks is a minute they can spend building a better product instead.
• Build compliance that enables the future. Soda is leveraging the massive capabilities of AI both in its product and in its internal operations. Our processes and controls need to keep up with the new world. You will adapt our compliance posture to this fast pace of change, with pragmatic solutions that keep/improve our compliance commitments without dragging down our speed in the market.
• Make our RFP and security-questionnaire answering hyper efficient. Compliance and security are important topics in every RFP and supplier due diligence process. You will make sure this is handled as efficiently as possible, using and expanding our existing tooling and making sure the most up-to-date references are used at all times.

And make it run. The other half is the programme itself, which has to stay audit-ready while you improve it:

• Own the annual SOC 2 Type II and SOC 3 cycle with our external auditor: planning, access, samples, our part of the report, and closing out findings.
• Keep the control set audit-ready all year: watch what's lapsing, chase what's failing, make sure nothing falls through the cracks.
• Run people compliance: the compliance steps in onboarding and offboarding, plus the yearly security training, code of conduct, incident-reporting and phishing cycles.
• Be Sales' compliance partner in enterprise security reviews, unblocking deals without promising things we don't do.

Who we're looking for

You've run a SOC 2 program or similar before at a SaaS company. You're comfortable being the only compliance person in the room and pragmatic about designing controls that work for a company our size.

Two things make or break this role. First, a lot of it is getting busy engineers to do something on time and prove they did it. You need to manage that, and find ways of making this as low-friction as possible for everyone involved. Second, you have to be able to build: not production software, but scripts, integrations, prompts, and AI-assisted workflows that hold up under an auditor's questions.

Because it's part-time and remote, we need someone predictable and self-directed, who runs their own agenda and flags early when something needs a decision from us.

Requirements

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company
• You have run a SOC 2 Type II cycle hands-on, including working directly with an external auditor through scoping, sampling and remediation
• Hands-on with a compliance automation platform: Drata ideally, or Vanta / Secureframe. You know what these tools genuinely automate and where they still need a person.
• Comfortable designing and implementing automations, including with AI
• Comfortable with the systems these controls run against: AWS, Okta, GitHub, endpoint management. Enough to judge whether evidence is real, not just whether a file was uploaded.
• Comfortable answering enterprise security questionnaires and holding your own live in a customer security review
• Clear written and spoken English, and the judgement to write a policy people can actually follow
• Available roughly 2–3 days per week, with solid working-hours overlap with CET
• Must be working in an EU time zone
• Able to invoice as a freelancer / contractor

Nice to have

• Technical experience
• Experience in a company under 200 people, where compliance is one person plus a lot of automation
• ISO 27001 experience
• A certification such as CISA, CISM, CIPP/E or ISO 27001 Lead Implementer

Benefits

• A real mandate to build a modern, forward-looking compliance system that keeps pace with and leverages opportunities created by the new AI reality
• A live, certified programme with enterprise customers depending on it, with full freedom to implement improvements
• A documented starting point: runbooks for every manual control, a scheduling system that tells you what's due, and a full written handover from your predecessor
• An AI-forward company that will actually fund and use what you build
• Direct access to decision-makers; no layers between you and the people who can fix things
• A competitive contractor rate