Clerk.dev

Compliance

• Own SOC 2 Type II and HIPAA end to end, including scoping, control design, evidence, auditor walkthroughs, and remediation
• Scope and lead the next compliance framework, likely ISO 27001, based on customer requirements
• Build and maintain integrations feeding the GRC platform from cloud providers, SaaS tools, and internal systems
• Convert controls into continuous checks using policy-as-code, configuration drift detection, and a control-failure pipeline
• Run the vendor security review program from intake through periodic re-review
• Own the security questionnaire and trust center workflow
• Maintain the risk register and conduct risk assessments producing documented decisions
• Embed compliance requirements into the SDLC and change management through tooling
• Reduce manual work required to pass quarterly audits

GRC Engineer