Compliance Enablement Technical Program Manager

Overview

As Technical Program Manager for the Trust and Assurance team, you will own the technical side of our compliance automation. You will validate controls in the GRC platform, ensure framework alignment, and gather evidence of effectiveness. You will partner with engineering to bake compliance into workflows from day one. You’ll combine strong GRC expertise with AI-enabled tooling to scale monitoring and reduce audit burden. This role offers impact at scale within Sophos’ security-first mission.

Pay / Benefits

• remote-first work model
• bonus eligibility
• comprehensive benefits package
• employee wellbeing programs
• charity and volunteering initiatives
• global sustainability programs

Responsibilities

• Act as the technical SME for the Trust and Assurance team, guiding decisions and improving workflows and tooling
• Oversee compliance stack: control mapping, evidence collection, monitoring workflows, and GRC integrations with cloud and internal systems
• Establish automated, continuous control monitoring to expand coverage and reduce manual audits
• Reduce audit burden by assigning owners, supporting gap assessments, and keeping controls audit-ready
• Embed compliance into engineering: partner with engineers to bake requirements into workflows from the start
• Drive initiative delivery to completion and communicate risk and progress to technical and non-technical audiences

Key requirements

• 4+ years in GRC, compliance, or a technical cybersecurity role with leadership experience
• Strong program and project management skills with cross-team delivery record
• Solid knowledge of NIST 800-53, ISO 27001, SOC 2, and/or FedRAMP with hands-on audit experience
• Technical depth in cloud infrastructure (AWS, Azure, or GCP), APIs, and data flows, with comfort using AI in compliance
• Experience with a GRC or compliance-automation platform (e.g., LogicGate, ServiceNow, Drata) and AI-assisted compliance workflows
• Strong written and verbal communication translating compliance to engineering and leadership
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent experience
• Desirable: coding/scripting in Python, AI/ML applications, API integrations, CI/CD pipelines, and security tooling familiarity
• Experience leading end-to-end audits (SOC 2 Type II, ISO 27001, FedRAMP, or NIST 800-53) and familiarity with OSCAL or similar tooling
• Familiarity with security monitoring tools (Tenable, Splunk), Git, and cloud automation tools (Terraform, Puppet, Jenkins)
• Experience in SaaS, GovCloud, FinTech, or other highly regulated environments
• Professional certifications (CISSP, CISM, CISA, CCSP, CCSK, ISO 27001 Lead Auditor)

• Proven ability to lead technical discussions with engineers and SMEs
• Excellent written and verbal communication
• Stakeholder management and cross-functional collaboration
• GRC platforms (LogicGate, ServiceNow, Drata)
• Cloud platforms (AWS, Azure, GCP)
• APIs and data flows understanding

…