Director of Data - Security, And Compliance

About the role

This role owns Syllo's data security compliance function and reports to the Head of Legal, Security, and Compliance. You ensure that Syllo's processes and policies support our certifications and satisfy the scrutiny of auditors and clients.

You will manage the renewal of Syllo's certifications, including our SOC 2 and ISO 27001 programs, and ensure compliance with internal policies for handling sensitive information. You will develop processes for providing clients key information, including responses to vendor security questionnaires (VSQs). The roles will also require you to define the security and configuration conditions that software must meet before Syllo adopts it for internal use. You will coordinate the response to security issues per policy, and ensure data is handled in a manner compliant with applicable privacy regimes.

This is a role that will require you to develop policies and procedures, sometimes from scratch. You are inheriting a program in progress, not a mature function. You will execute directly today while building and scaling the team over time.

We are looking for someone who has owned compliance programs end to end, not just contributed to ones someone else ran. Judgment, ownership, and the ability to operate at the intersection of legal, technical, and commercial considerations are the core requirements.

This position includes opportunities for growth into product-related security responsibilities and team building as the company continues to mature.

What you will do

• Own the compliance program: Manage SOC 2 Type II and ISO 27001 certification cycles end to end: scope, evidence, auditor relationships, and remediation. Ensure Syllo's processes and policies support these certifications. You own the program, not the platform's technical controls.
• Run the VSQ process: Own vendor security questionnaire responses across the enterprise sales pipeline. Quality and turnaround time are both metrics.
• Build policy infrastructure: Design and maintain data handling policies, disaster recovery plans, and incident response procedures.
• Set software acceptance conditions: Define the security and configuration standards software must meet before it enters the Syllo stack. Approve additions against those standards.
• Coordinate incident response: When a security issue arises, drive the response per the incident response plan. You coordinate the right owners rather than perform the technical investigation.
• Own privacy processes: Ensure data is stored in a manner compliant with applicable privacy regimes, and that processes exist for responding to inquiries made under them. Work consultatively and cross-functionally with engineering on implementation.
• Advise cross-functionally: Serve as the compliance voice across operations and commercial conversations.

What you bring

• Compliance program ownership: You have built and run SOC 2 and ISO 27001 programs, not just participated in audits someone else managed.
• VSQ and audit cycle depth: You have developed process and tools for responding to security questionnaires from enterprise and law firm procurement teams under time pressure.
• Policy and DR expertise: You have designed data handling policies, disaster recovery documentation, and incident response procedures that have held up to auditor and customer scrutiny.
• Privacy fluency: You understand how privacy regimes bear on data storage and inquiry response, and you can translate requirements into process alongside an engineering team.
• Cross-functional judgment: You know when to escalate a compliance issue and when to resolve it at the working level.
• Technical fluency: You are conversant in the security infrastructure underlying compliance programs. Not a hands-on engineer, but not dependent on one for basic understanding.

Experience and qualifications

• 5+ years in a Director-level position or equivalent with responsibilities for oversight of overall security compliance for an organization or ownership of security compliance for the commercial function of an organization.
• Direct ownership of SOC 2 and ISO 27001 compliance programs.
• Demonstrated experience managing VSQ processes at volume across enterprise sales pipelines.
• Experience building compliance programs at high-growth B2B SaaS companies preferred.
• CISSP, CISM, or equivalent certification preferred.
• Bachelor's degree required. Advanced degree a plus.

Total rewards and benefits

At Syllo, we believe in taking care of our team so they can focus on building the future of legal tech.

Compensation: Competitive base salary + equity options.

Benefits: Medical, dental, vision, and voluntary insurance options. Vacation, sick leave, and paid holidays. Access to benefit counselors and fitness class reimbursements.

United States - Remote Pay Range 250000 - 310000 USD