Own Finix’s PCI DSS Level 1 service-provider and SOC 2 Type II compliance programs from audit planning through reporting and remediation. Manage QSAs and external auditors, coordinate evidence collection and control testing, maintain compliance frameworks and policies, conduct risk and vendor assessments, support BCP/DR, respond to security questionnaires, and report compliance risks and metrics to leadership.
About Finix
Finix is building the global operating system for fintech, starting with payments. From startups to publicly traded companies, Finix processes tens of billions of dollars annually both in-store and online. Finix was founded in 2015 and is headquartered in San Francisco.
To date Finix has raised over $200M, including a $75M Series C led by Acrew Capital and Lightspeed Venture Partners and backed by American Express Ventures, Bain Capital Ventures, Homebrew, Inspired Capital, Visa, and others
About the role
The Information Security organization at Finix protects our platform, our customers, and the data they trust us with. As a Compliance Program Manager, you will own Finix’s compliance program end to end, from audit planning and control design to evidence collection and remediation. You will work closely with Engineering, Information Security, Legal, and IT.
You Will:
- Own Finix’s PCI DSS program as a Level 1 service provider, including scoping, the annual ROC and AOC, and ongoing compliance between assessments
- Own the SOC 2 Type II program, including audit planning, control design, and the annual report
- Manage relationships with QSAs and external auditors, and lead audit fieldwork from kickoff through final report
- Partner with control owners across teams to collect evidence, test controls, and drive remediation of findings
- Maintain policies, procedures, and the control framework mapped across PCI DSS, SOC 2, and other regulatory requirements
- Run risk assessments, third-party vendor risk reviews, BCP/DR etc
- Respond to customer security questionnaires, partner due diligence requests, and compliance attestation requests
- Track compliance metrics and report program status and risks to leadership
- Build and improve compliance processes as Finix scales into new products and markets
You Have:
- 5+ years in compliance, audit, or GRC in payments or fintech
- PCI DSS experience as a service provider, including ROC assessments with a QSA
- Hands-on SOC 2 experience, including owning or supporting Type II audits
- Experience working with external auditors, or working as an external auditor or QSA
- Clear written and verbal communication, including presenting audit results and risks to technical and non-technical audiences
- Experience with GRC platforms such as Drata or Vanta
- General technical background and comfort discussing systems, infrastructure, and security controls with engineers
Nice to Have:
- Working knowledge of cloud infrastructure, especially AWS
- Internal audit experience
- Certifications such as CISA, PCI ISA, PCI QSA, or CISSP
Finix San Francisco, California, USA Office
71 Stevenson Street, San Francisco, CA, United States, 94105
Similar Jobs
.png)
eCommerce • Fintech • Hardware • Payments • Software • Financial Services
Owns quality assurance for cryptocurrency and sanctions compliance programs, including sampling, decision reviews, metrics, risk reporting, corrective actions, and continuous improvement. Partners with BSA/CFT and Sanctions program owners and leadership to ensure compliance standards align with regulatory requirements and product growth. Requires deep AML, KYC, sanctions, and fintech compliance expertise, strong analytical and communication skills, executive influence, and AI fluency.
Top Skills:
Ai/Ml-Driven Compliance ToolsArtificial IntelligenceCryptocurrencyMachine LearningRisk-Decisioning Tools
Blockchain • eCommerce • Fintech • Payments • Software • Financial Services • Cryptocurrency
Own quality assurance for cryptocurrency and sanctions compliance decisions, including sampling, monitoring, error-rate reporting, risk analysis, corrective actions, and continuous improvement. Partner with BSA/CFT and Sanctions program owners, report metrics and insights to leadership, ensure standards align with regulatory requirements and product growth, and maintain the broader compliance quality framework.
Top Skills:
Ai/Ml-Driven Compliance ToolsCryptocurrency
Greentech • Energy • Utilities • Industrial
Manages regional commercial compliance programs across multiple states, serving as the primary client contact while conducting EHS audits, hazard assessments, hazardous waste reviews, inspections, and training. Oversees schedules, subcontractors, deliverables, corrective actions, regulatory responses, and client relationships. Advises clients on OSHA, EPA, DOT, RCRA, and state requirements, supports agency inspections, identifies follow-up opportunities, and travels extensively throughout the Western United States.
Top Skills:
Dot HmtEpaHazwoperIso 14001Iso 45001MS OfficeNpdes MsgpOshaRcraSpccTier Ii ReportingWeb-Based Ehs Data Platforms
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine
