Compliance Manager

Compliance Manager

We're looking for a Compliance Manager to own and mature our compliance program as we scale. You'll be the primary driver of our SOC 2 Type 2 audit program for 5 products, and will provide critical support across SOX, privacy, PCI, HIPAA, and additional regulatory and professional framework compliance efforts. This is a hands-on role for someone who enjoys building repeatable processes, working cross-functionally with engineering and IT teams, and translating regulatory and contractual requirements into practical, auditable controls for business units. You'll lead a small team: analysts, contractors, stakeholders - making this a great opportunity for someone ready to take on people leadership while staying close to the technical and operational details of compliance work.

What you'll do:

• SOC 2 Type 2: Own the end-to-end audit lifecycle — scoping, control design, evidence collection, auditor liaison, remediation tracking, and continuous monitoring between audit cycles.
• SOX Support: Assist with IT general controls (ITGCs) testing, walkthroughs, and coordination with internal audit and external auditors to support financial reporting compliance.
• Privacy Audits: Support privacy compliance efforts (e.g., GDPR, CCPA/CPRA) including audit prep, control validation, and documentation of data handling practices.
• PCI Compliance: Support PCI DSS assessments, including scoping, control validation, and coordination with payment processing and engineering teams.
• Data Processing Addendums (DPAs): Review, negotiate and track DPAs with customers, vendors, and subprocessors, ensuring alignment with our data protection commitments and privacy obligations.
• Vendor & Third-Party Risk: Assess subprocessors and vendors for compliance posture and contractual data protection requirements.
• Controls Oversight: Partner with Engineering, IT, and Security teams to design, implement, and monitor controls; maintain a strong evidence trail and control library.
• Policy & Process: Maintain and evolve compliance policies, procedures, and control narratives to reflect the current environment and audit requirements, including ensuring NEO and annual training is released and accurate.
• Audit Readiness: Serve as a key point of contact for external auditors, customer security questionnaires, and due diligence requests.
• Continuous Improvement: Identify opportunities to automate evidence collection and streamline control monitoring using GRC tooling.

Our ideal candidate will have:

• 4+ years' of experience in compliance, information security, or IT audit, with direct experience running or supporting SOC 2 Type 2 audits.
• Working knowledge of SOX ITGC concepts, privacy frameworks (GDPR/CCPA), and PCI DSS requirements — you don't need to be a deep expert in all four, but you should be comfortable supporting each.
• Experience reviewing contract terms.
• Familiarity with common control frameworks (e.g., HIPAA, AICPA Trust Services Criteria, NIST CSF, ISO 27001).
• Prior experience managing or mentoring junior team members or contractors.
• Strong written and verbal communication skills — you can explain control requirements to engineers and translate technical detail for auditors and leadership.
• Comfortable working in a fast-paced SaaS environment with evolving systems and processes.
• Bachelor's degree in a related field, or equivalent practical experience.
• Experience working with GRC platforms (e.g., Vanta, Drata, OneTrust, ServiceNow GRC) is a strong plus.
• Relevant certifications: CISA, CISM, CIPP/E, CIPP/US, or similar.
• Experience supporting multiple concurrent audit cycles in a SaaS or cloud environment.
• Experience with cloud infrastructure (AWS, GCP, or Azure) and understanding of how technical controls map to compliance requirements.

Physical Requirements:

• This position works most of the time in a fixed office location and may involve sitting and/or standing for prolonged periods
• Frequently required to communicate verbally and in writing (mostly email) with customers, prospects, and other employees
• Use of computer, telephone, and other office equipment for the greater part of the workday
• Occasional travel may be required for this position

Why Procare?

• Excellent comprehensive benefits packages including: medical, dental, & vision plans
• HSA option with employer contributions
• Vacation time, holidays, sick days, volunteer & personal days
• 401K Plan with employer match and immediate vesting
• Employee Stock Purchase Plan
• Employee Discount Program
• Medical, Dependent Care, and Transportation FSA Plans
• Company paid Short and Long-Term disability and Life Insurance
• RTD EcoPass for all Denver employees
• Tuition Reimbursement and continued Professional Development
• Fast paced, high energy workplace environment in prime downtown location
• Regular company provided meals

Salary

$139,400 - $150,700/year DOE

Location

This position can be based in our Denver, CO or Atlanta, GA offices. Procare operates in a hybrid working model based on business needs. Candidates must be willing and able to work in office a minimum of 3 days per week.