Security & Compliance Manager (GRC)
Somana is a generative robotics company. We founded the company because the incredible advances in the modeling layer have no way to access a fragmented physical world. We're building the connective tissue that brings physical AI into the industrial world.
Somana develops hardware, software, and a services platform powering rapid improvements in capacity, throughput, yield, and quality. Somana's platform processes sensitive customer data from industrial and robotics environments, and our enterprise customers expect demonstrable security before they deploy. The Security & Compliance Manager will own the company's security compliance program end to end - building and maintaining the SOC 2 program, managing customer security reviews, and ensuring our controls meet the standards our customers and auditors require. This role is central to how we earn and keep enterprise trust. You'll own that trust narrative and collaborate closely with leadership and operations teams to define and launch new processes and training as we scale.
Please note: Applicants must be a U.S. Person (as defined by 22 CFR 120.62) due to required access to U.S. export-controlled information or facilities.
Responsibilities
Run the SOC 2 program end to end: auditor relationship, compliance platform, evidence collection, policy lifecycle, and security awareness training
Own customer security questionnaires and security reviews - turn them around fast enough to keep deals moving, and use them as a signal for what to fix internally
Run quarterly access reviews and own third-party risk for vendors and contractors
Partner with engineering to make realistic controls - from read architecture, verifiable control implementation, and drive remediation when needed
Maintain the risk register and track findings to closure across audit cycles
Represent Somana in customer audits and formal assessments, clearly explaining security posture, governance decisions, and risk management approaches.
Maintain the compliance platform health (continuous monitoring, automated evidence)
Required
3+ years in GRC or security compliance
Has led a SOC 2 audit end to end, from readiness through report
Hands-on experience running a compliance platform (Vanta, Drata, Oneleet, or similar)
Ability to read system architecture and talk credibly with engineers - you can tell the difference between a control that exists and a control that's documented
Comfortable owning a program with minimal scaffolding at an early-stage company
Nice to have
Has taken a company from SOC 2 Type 1 to Type 2
Background at a fintech, SaaS, or other data-intensive company where customer data quality and handling were core to the product
Experience navigating cross-border data transfer, residency, and localization consideration in a multi-cloud environment.
Built a GRC program from scratch (0 to 1), not just maintained an inherited one
Working breadth across ISO 27001, GDPR/CCPA, and standard vendor questionnaires (SIG, CAIQ)
Relevant certifications (CISA, CISSP, ISO 27001 Lead Auditor) are a plus but not a substitute for hands-on audit experience
Location and Compensation
SoHo, New York City
Competitive salary + meaningful equity - this is a foundational role on a small team
Catered lunch, snacks, panoramic views, and pet-friendly office
Health, Dental, Vision, Life and HSA benefits + 401k