InfoSec Engineer (Risk and Compliance)

At Rox, we believe in empowering people to do their best work.

Our platform supercharges sellers with autonomous revenue agents to do the manual work so they can focus on what they do best: selling. Just as coding agents 10x’d engineering, revenue agents 10x customer work.

We are reimagining the revenue stack by building the world’s first revenue operating system, from the application layer to the system of context. With Rox, humans are evolving to orchestrators while agents manage the end-to-end customer lifecycle.

Rox powers Global 2000 leaders in banking, hardware, construction, and sovereign AI, while serving dominant AI winners like Ramp and Cognition.

Underlying all of this success is an unwavering, shared belief in the mission, with an unreasonable commitment of doing whatever it takes to make it a reality.

Nothing is possible without the world-class team, assembled to redefine how businesses operate.

Members on our team have:

• Founded and exited successful companies

• Held the highest positions at Google, AWS, Confluent, and New Relic

• Won IMO and IOI gold medals

• Published field-defining papers

We’re backed by the best, including Sequoia, General Catalyst, Google Ventures, Elad Gil, and Chris Ré.

No matter how small, we strive to make sure every detail is right. We care deeply about every interaction, both in terms of whether it helps the seller get the job done, but also how the product makes them feel. We get a visceral feeling when something is off and stop at nothing to make sure we make it right. We never settle, continuously exploring ways to delight sellers.

In all aspects of our craft, we commit. We not only are immediately reactive to customers’ requests but are proactive about driving value even before they ask. We are also obsessive about always learning and honing our craft, improving ourselves and product every single day.

Talking is easy but the difference comes from the execution. We lean heavily towards making thoughtful yet fast decisions and delivering immediately. We play in a field where trust is paramount. We earn the trust and right to empower the best sellers by forging a history of over-delivering on the promise at record speed.

Rox agents read and act on our customers’ most sensitive revenue data. Global 2000 security teams review us closely before they sign, and the trust we earn in those reviews is a core part of how we win and keep enterprise customers.

As an InfoSec Engineer (Risk and Compliance), you will own our compliance program as an engineer, not as a checklist keeper. You will run ISO 27001 and SOC 2, lead customer security due diligence, and manage vendor risk. You will also write the Python that collects evidence and monitors controls automatically, so audits stop eating the team’s time.

This is a senior individual contributor role and the second hire on our security team. You will report to Mike Tan, our Head of Security, and work closely with Engineering and Infrastructure on controls and fixes, and with Legal and Finance on security addenda, data processing agreements, and vendor contracts. Within your first three months you will fully own four areas with little supervision.

• Compliance automation (30%): Build scripts and integrations in Python against REST APIs that collect evidence, monitor controls, and generate reports. Replace manual screenshots with compliance as code.

• Audit operations (30%): Own the ISO 27001 certification program, including audit findings, the Statement of Applicability, the risk register, and internal audit. Keep SOC 2 compliance continuous: fix failing tests, answer evidence and auditor requests, maintain policies, and run access reviews.

• Customer security due diligence (20%): Run the customer security review queue end to end, from questionnaires (CAIQ, SIG, and custom) to security addenda and due diligence calls with enterprise security teams.

• Vendor and risk management (20%): Assess vendors, review sub-processors, and keep the risk register current as Rox adds new tools and partners.

• Partner with Engineering and Infrastructure on the systems behind the evidence: AWS, the software development lifecycle, change management, and vulnerability fixes.

• Partner with Legal and Finance on data processing agreements, customer security addenda, and vendor procurement.

• First 3 days: You have access to Secureframe, AWS, and GitHub, can explain our SOC 2 and ISO 27001 control set and where each framework stands, and have worked a live customer security questionnaire with our Head of Security.

• First 3 weeks: You run the customer security review queue end to end and have automated evidence collection for at least one recurring audit control.

• First 3 months: You fully own ISO 27001, continuous SOC 2 compliance, customer security due diligence, and vendor risk management, and you have shipped tooling that cuts recurring manual audit work.

• 4+ years in GRC or security compliance, with hands-on experience running SOC 2 and ISO 27001 audits.

• You code. You write Python scripts and API integrations to automate evidence collection and control monitoring, and you are comfortable with SQL and Git.

• Working knowledge of AWS security services and logs, such as IAM, CloudTrail, KMS, and Config.

• Experience with a GRC platform such as Secureframe, Vanta, or Drata.

• Experience answering enterprise security questionnaires (CAIQ, SIG) and joining due diligence calls with customer security teams.

• Familiarity with GDPR and data processing agreement concepts.

• You own outcomes with little supervision and can explain risk clearly to engineers, executives, and customers.

• Be located in or willing to relocate to San Francisco. This role is onsite at our SF HQ five days a week.

• Led an ISO 27001 certification or a first SOC 2 Type II from scratch.

• Experience with JumpCloud, Datadog, or Semgrep.

• Experience managing third-party risk at a fast growing B2B SaaS or AI company.

• Competitive pay with considerable equity upside (base salary range: $180,000 to $220,000 USD)

• Medical, dental, and vision, including 100% company-paid plans for you and eligible dependents

• Company-paid life & AD&D, plus short- and long-term disability

• 401(k) with automatic enrollment

• Unlimited PTO, plus paid sick leave, company holidays, and bereavement

• Up to 20 weeks of paid parental leave at 100% pay (birth, adoption, or foster)

• Wellness stipend: $375/quarter

• Learning stipend: up to $2,000/year

• Internet & cell phone stipend: $25/month

• Mental health support, virtual care, and care navigation

• Fertility & family-building support, plus backup care membership

• Pre-tax commuter benefits (transit & parking)

• SF HQ: daily catered breakfast & lunch, meal allowances, and rideshare support when commuting to the office

To apply, please fill out the application form. We're looking forward to connecting with you!