Security and Compliance Manager (GRC)

Security & Compliance Manager (GRC)

Somana is a generative robotics company. We founded the company because the incredible advances in the modeling layer have no way to access a fragmented physical world. We're building the connective tissue that brings physical AI into the industrial world.

Somana develops hardware, software, and a services platform powering rapid improvements in capacity, throughput, yield, and quality. Somana's platform processes sensitive customer data from industrial and robotics environments, and our enterprise customers expect demonstrable security before they deploy. The Security & Compliance Manager will own the company's security compliance program end to end - building and maintaining the SOC 2 program, managing customer security reviews, and ensuring our controls meet the standards our customers and auditors require. This role is central to how we earn and keep enterprise trust. You'll own that trust narrative and collaborate closely with leadership and operations teams to define and launch new processes and training as we scale.

Please note: Applicants must be a U.S. Person (as defined by 22 CFR 120.62) due to required access to U.S. export-controlled information or facilities.

Responsibilities

• Run the SOC 2 program end to end: auditor relationship, compliance platform, evidence collection, policy lifecycle, and security awareness training

• Own customer security questionnaires and security reviews - turn them around fast enough to keep deals moving, and use them as a signal for what to fix internally

• Run quarterly access reviews and own third-party risk for vendors and contractors

• Partner with engineering to make realistic controls - from read architecture, verifiable control implementation, and drive remediation when needed

• Maintain the risk register and track findings to closure across audit cycles

• Represent Somana in customer audits and formal assessments, clearly explaining security posture, governance decisions, and risk management approaches.

• Maintain the compliance platform health (continuous monitoring, automated evidence)

Required

• 3+ years in GRC or security compliance

• Has led a SOC 2 audit end to end, from readiness through report

• Hands-on experience running a compliance platform (Vanta, Drata, Oneleet, or similar)

• Ability to read system architecture and talk credibly with engineers - you can tell the difference between a control that exists and a control that's documented

• Comfortable owning a program with minimal scaffolding at an early-stage company

Nice to have

• Has taken a company from SOC 2 Type 1 to Type 2

• Background at a fintech, SaaS, or other data-intensive company where customer data quality and handling were core to the product

• Experience navigating cross-border data transfer, residency, and localization consideration in a multi-cloud environment.

• Built a GRC program from scratch (0 to 1), not just maintained an inherited one

• Working breadth across ISO 27001, GDPR/CCPA, and standard vendor questionnaires (SIG, CAIQ)

• Relevant certifications (CISA, CISSP, ISO 27001 Lead Auditor) are a plus but not a substitute for hands-on audit experience

Location and Compensation

• SoHo, New York City

• Competitive salary + meaningful equity - this is a foundational role on a small team

• Catered lunch, snacks, panoramic views, and pet-friendly office

• Health, Dental, Vision, Life and HSA benefits + 401k