Compliance and Security Lead

Security at Ada

Ada's AI Agent resolves customer service conversations for enterprises — which means our customers trust us with their customers' data and their brand. Security and compliance are how we earn and keep that trust. The Security team partners across engineering, legal, and go-to-market to make sure Ada's controls are real, evidenced, and easy for customers to verify.

Our Role

As Compliance & Security Lead, you own Ada's security compliance program end to end: audits, customer trust, vendor risk, vulnerability management, and the control framework that ties it all together. Our audit season runs August through November — your mandate is to automate evidence collection and process to the point where the team is audit-ready year-round, not scrambling seasonally. You are the internal source of truth on compliance status and the external face of Ada's security posture: you will own security conversations with enterprise prospects and customers. As agentic AI regulation takes shape (starting with AIUC), you translate framework movement into concrete requirements for the platform team.

About You

• Deep audit experience across SOC 1, SOC 2, PCI DSS, NIST frameworks, AICPA standards, and PII/privacy requirements. You have run audits end to end: evidence collection, control mapping, and auditor coordination.
• Experience working directly with major audit firms such as Deloitte or EY; you know what a gold-standard audit engagement looks like from the inside.
• You have inherited manual compliance programs and driven them toward automation tooling, process, and repeatability (Drata or similar compliance automation platforms).
• Vulnerability management at scale: you have taken a large vulnerability backlog (thousands of findings) and driven it down through prioritization, ownership, and process.
• Customer-facing confidence: you own the room in security posture conversations with enterprise prospects, and you are equally comfortable saying "let me get back to you" and then actually getting back to them.
• An engineering background is preferred but not required; you must understand modern infrastructure,  Kubernetes, Terraform, CI/CD! well enough to hold your own with engineers and auditors alike.
• Experienced owner of RFP security sections, customer security questionnaires, and trust centers (SafeBase or similar).
• Strong writer: policies, control documentation, and data handling standards that people actually follow.
• Proactive owner who builds programs that outlast you: process, documentation, and tooling over heroics.
• You track regulatory and framework movement interest in agentic AI governance (AIUC and emerging frameworks) is a strong plus.

Outcomes

• Own Ada's security audits end to end: the upcoming AIUC audit, PCI, and SOC 2. Evidence collection, control mapping, and auditor coordination, run through Drata.
• Automate evidence collection and control monitoring so that audit season (August–November) no longer requires heroics the team is audit-ready year-round.
• Own the security and compliance sections of customer RFPs and security questionnaires. Maintain the SafeBase trust center so deals stop stalling on security review.
• Own vulnerability management as a program: drive the backlog down with clear prioritization, ownership, and SLAs for critical findings.
• Run vendor security and privacy reviews as a standing process with clear SLAs, not one-off scrambles.
• Maintain the control framework and its documentation: policies, data handling, retention, and the evidence that controls actually operate.
• Be the point of contact for customer security, privacy, and legal teams, and the internal source of truth on compliance status.
• Track regulatory and framework movement relevant to agentic AI, starting with AIUC, and translate it into concrete internal requirements for the platform team.
• Take ownership of the compliance work currently spread across the team, and make it sustainable.
• First 90 days: take full ownership of the AIUC audit, produce a current-state gap assessment against our target frameworks, and turn the RFP security response into a repeatable process.

#LI-NS1