About Mobbin

Our mission is to empower the world to design great digital experiences.

Mobbin helps designers and product people find highly-relevant references to their design problems. Today, Mobbin is serving over 3 million users and is used by most design-forward companies such as Wise, Airbnb, Headspace, Duolingo, Uber, and more.

Read more about who we are: https://careers.mobbin.com

The role

We’re hiring a Security & Compliance Lead to work alongside our existing lead and keep Mobbin’s security, privacy and compliance programme running as the company grows quickly.

You’ll start by owning our external compliance work: enterprise contract reviews, customer security reviews, our SOC 2 audit and our public legal terms. You’ll work closely with sales, external counsel, our auditor and our insurer. You don’t need an engineering background, but you do need to be security-literate enough to ask engineers the right questions, trace a request or issue all the way through, and verify answers rather than assume them.

Together, you and your peer will cover the full programme. Your peer focuses on internal security and hardening; you focus on external compliance. You’ll each stay familiar with the other’s work so the programme never stalls when one of you is away.

Our team is small, so this is a hands-on role. You’ll help us protect customer data, meet our commitments to enterprise customers, and build security into how we develop and operate our product.

(This role starts in 2027)

What you’ll do…

• Own enterprise contract reviews. Review and redline customer agreements, hold our standard positions, route deviations to counsel, and track which MSA version each customer signed.

• Triage deals with sales. Qualify incoming requests, decline out-of-tier terms, help price higher liability caps, and keep the deal tracker current.

• Answer customer security reviews. Handle questionnaires, TPRM portals and follow-ups, and check our exposure when new advisories land.

• Run audits and external relationships. Run our SOC 2 audit, handle insurance applications and disclosures, and brief external counsel on risk.

• Maintain our public terms. Keep our ToS, privacy policy, MSA and DPA current.

• Triage researcher and abuse reports. Handle bug bounty submissions and misuse or resale reports.

• Provide cover. Keep enough context on your peer’s internal work (privacy requests, vendors, security operations) that either of you can step in.

You should…

• Verify before you conclude. You trace things to the end and don’t act on assumptions you haven’t checked.

• Learn fast from feedback. Once something is corrected, you apply the lesson in new situations without being told.

• Have reviewed and negotiated customer contracts (MSAs, DPAs, security addenda), and know when to hold a position and when to escalate to counsel.

• Have run or supported a SOC 2 (or similar) audit and answered enterprise security questionnaires.

• Make proportionate risk decisions and recognise when specialist input is needed.

• Be comfortable working directly with customers and legal, and juggling requests across several teams at once.

• Ask questions early and build your own network across the team, rather than proving independence by working alone.

It would be a bonus if you have…

• A technical background, or comfort reading code, querying data and examining logs.

• Experience with cyber insurance applications, bug bounty programmes, or building a GDPR programme.

• Experience reviewing the security of AI features, MCP integrations, or other systems that connect models to customer data and tools.

• Experience configuring compliance automation platforms, identity and device management systems, or web application firewalls.

• Experience improving security incident response, running exercises, or building monitoring and evidence automation.

We offer…

• Competitive salary

• Revenue-sharing after a one-year cliff

• Work-life balance

• Flexible work hours

• Health & fitness benefits

• Health insurance, medical coverage, and dental coverage

• Work from anywhere (Singapore office or remote)

• Yearly company retreat

• Apple equipment