Governance‑first role owning security/compliance programs. Mature SOC 2 and HIPAA in place; lead GDPR depth and drive PCI DSS to attestation while sustaining existing programs. Responsibilities: design control sets, automate evidence, run audit cycles, keep policy current, handle customer security reviews; manage corporate IT areas (identity, endpoint, SaaS estate); maintain risk register and assessments; keep scope current as platform evolves; support enterprise diligence and trust center; maintain IR/BC/DR readiness. What We’re Looking For: 8+ years in compliance/GRC/security governance with program ownership; built programs from near zero; SOC 2 Type II depth; genuine GDPR fluency; pragmatic policy/judgment; hands‑on identity/device/SaaS admin; systems thinking; engineering empathy; clear communication; certifications welcome (CISSP/CISA/CIPP/E). Bonus: PCI DSS service‑provider experience; ISO 27001; data‑infrastructure context; Vanta/Drata/Secureframe; public sector frameworks; startup grit. Why Estuary: competitive comp/equity/benefits; flexible remote; high‑autonomy impact; quarterly offsites.