Lead Security Compliance Engineer

At Klaviyo, we value the unique backgrounds, experiences and perspectives each Klaviyo (we call ourselves Klaviyos) brings to our workplace each and every day. We believe everyone deserves a fair shot at success and appreciate the experiences each person brings beyond the traditional job requirements. If you’re a cl...

At Klaviyo, we're on a mission to empower creators to own their destiny. Our AI-first B2C CRM platform empowers 176,000+ brands in 80+ countries to cultivate relationships with hundreds of millions of consumers. We love solving hard problems and look for people who specialize in certain areas while being passionate ...

As a Lead Security Trust & Compliance Engineer at Klaviyo, you'll be the primary owner of two or more of our Trust & Compliance programs — compliance operations & audits, continuous control monitoring, security policies & standards, security education & awareness, and customer trust operations among them. You'll set...

 
In-depth understanding of multiple security and privacy frameworks — such as NIST CSF 2.0, CIS Critical Security Controls, CSA STAR, ISO 27001, ISO 27002, ISO 27017, ISO 27018, ISO 27701, ISO 42001, SOC 1, SOC 2, PCI, HIPAA, SOX ITGCs, GDPR, CCPA, and CPRA — including the ability to identify gaps against a framework that is new to the organization, define the strategy, and execute the implementation
A track record of personally owning security and privacy compliance audit programs end to end, including acting as the primary interface to internal and external auditors through scoping, walkthroughs, and findings resolution
Experience writing policies and standards that are precise enough to test and clear enough for engineers to follow, including ownership of the review and exception processes around them
Deep experience designing, assessing, and continuously monitoring modern security and privacy controls, including determining control design for net-new controls and diagnosing deficiencies from system configurations, technical documentation, security tool data, and application code
Experience with GRC engineering and security automation in general, especially applying AI and automation to eliminate toil
Knowledge of various enterprise SaaS applications, cloud infrastructure such as AWS and Kubernetes, modern software engineering practices/tools, databases, operating systems, secure network design, and other technology relevant to cybersecurity
Experience owning programs against defined KPIs and SLAs, including setting quarterly strategy, planning the work, and reporting on progress
A track record of mentoring practitioners, delegating effectively, and driving technical direction without formal authority
Excellent interpersonal and communication skills and the ability to form relationships with internal and external teams.

 
 
Familiarity with modern compliance automation or trust management platforms (Drata, Vanta, Anecdotes, HyperProof, etc.)
Experience with SQL, building tools with REST APIs, and Python
Infrastructure-as-code or policy-as-code experience (Terraform, OPA/Rego, Conftest)
Building with agentic AI tooling (MCP, agent skills, evals and guardrails) and/or governing AI controls against ISO 42001 or NIST AI RMF
Experience implementing Identity Governance tools and processes, such as for user access reviews (UARs) and just-in-time access (JITA)
Experience working in security operations, security engineering, and/or security architecture roles
Relevant certifications, such as CISA, CISSP, or CCSP