Compliance Operations

Enterprise customers trust Poetic with their most critical business processes. Your job is to ensure that trust scales as quickly as the rest of the company.

You will build and own Poetic’s compliance program end-to-end — including obtaining and maintaining certifications such as SOC 2, HIPAA, PCI DSS, ISO 27001, and more. This involves coordinating audits, partnering with engineering to implement technical controls, responding to enterprise customer security reviews, and building the operational systems that allow compliance to scale.

We don’t think of compliance as back-office paperwork. We think of it as a competitive advantage. Vendor reviews completed fast enough that our champions brag about them internally. Security reviews that turn skeptical prospects into advocates. Procurement so painless that it becomes a reason customers choose Poetic. Your job is to build the operational trust that allows the company to move faster, not slower. This role will accelerate our GTM if done correctly.

You will be building this function from the ground up as the first dedicated hire. We expect you to get scrappy, automate aggressively, and rethink how modern compliance should operate. You’ll build workflows, dashboards, and automations on top of Poetic itself to eliminate manual work and make compliance increasingly self-driving.

By the end of your first quarter, Poetic should be dramatically more audit-ready, enterprise-ready, and operationally mature because of the systems you’ve built.

Responsibilities

• Own Poetic’s compliance program across SOC 2, HIPAA, PCI DSS, ISO 27001, and future frameworks

• Keep the company continuously audit-ready by maintaining policies, controls, documentation, evidence, and remediation tracking

• Lead external audits end-to-end, coordinating auditors and internal stakeholders to ensure nothing falls through the cracks

• Build automations that eliminate manual compliance work and improve operational efficiency

• Partner with Engineering and IT to implement, validate, and document technical security controls

• Own customer security questionnaires, trust documentation, and security reviews so compliance never slows down enterprise sales

• Manage third-party vendor risk, assessments, and ongoing reviews

What we’re looking for

• Exceptional operational rigor and project management

• You will not drop a single ball, and you are good at spotting edge cases and items that could fall through the cracks

• Ability to coordinate complex cross-functional work involving engineering, finance, legal, HR, external auditors, and enterprise customer teams

• Strong written communication and documentation skills

• Technically literate enough to understand or can teach yourself how to understand cloud infrastructure, identity systems, and basic security architecture

• Building ability - you should be comfortable using e.g. Claude to build a simple tool or automation to automate repetitive work

• High agency - you want to push the bounds further than even we’ve imagined to make Poetic and compliance here world-class

• Some relevant backgrounds include experience in IB/PE/consulting, bizops, and corporate finance

You will stand out if

• You have experience owning or helping lead a compliance program for frameworks such as SOC 2, HIPAA, PCI DSS, ISO 27001, or another framework

• You have experience at an early-stage startup

• You actively build automations with AI that reduce ongoing manual work

• You have partnered closely with engineering teams

• You have been involved in enterprise customer sales and procurement processes

• You have cybersecurity knowledge or experience

This role is not for you if

• You want a mature program to maintain rather than a function to invent

• Your first instinct is to buy a GRC suite and configure it - ours is to build the workflow on our own platform

• You think "no" or "you can't" is a complete response to a request

• You'd rather file a ticket than walk over to an engineer's desk

• Being the first and only person in a function sounds lonely instead of thrilling

This role is about building the operational trust layer that enables Poetic to win the world’s largest enterprises and allows us to scale with them as we re-found the largest industries in the world.

San Francisco location preferred.