Compliance Program Manager

PlanetScale is growing rapidly and reinventing the database space. Our database platform offers developers the fastest and most reliable Postgres and Vitess/MySQL databases, enabling businesses to efficiently handle data and workloads of all sizes.

PlanetScale is backed with over $100M in venture financing from top-tier VCs including a16z, Kleiner Perkins, SignalFire, and Insight Venture Partners. And we serve some of the most innovative companies in the world such as Block, Anysphere (Cursor), MyFitnessPal, Etsy, Kick, and thousands more. Our customers entrust us with what is often their most precious digital asset, their data, so the stakes couldn’t be higher.

We’re look for a Program Manager to oversee the FedRAMP certification process, as well as ongoing management and evolution of our existing compliance commitments, including SOC 1, SOC 2, and PCI DSS compliance. PlanetScale’s security and compliance team is responsible for our corporate information security program, with a goal to reduce risk across our systems, and to establish trust in our product offerings, features, and cloud services. Our work is focused on both our internal employees and our external customers and partners.

What You’ll Do

• Take primary responsibility for overseeing PlanetScale’s FedRAMP readiness and ATO process from start to finish

• Act as the main compliance point of contact for all audits/assessments (i.e. SOC 1 & 2, PCI, FedRAMP) including audit plan preparation, review of documentation and evidence, evaluation of procedures, and external walkthroughs

• Establish, track, and report on key performance indicators and maturity metrics related to audit and compliance programs

• Work collaboratively across many internal teams (IT, Engineering, Legal, and People) to identify, manage, and implement solutions related to privacy, data protection risks, and compliance requirements to help meet our customer’s high expectations for data protection and privacy

• Leverage knowledge of industry standards and best practices to assess the current state of security and compliance risks, identify areas of exposure, and continuously address the gaps by proposing and implementing remediating controls

What We’re Looking For

• 5+ years of experience contributing to and/or managing audits for a company in the technology sector, including demonstrable experience and subject matter expertise in FedRAMP.

• Experience with SOC 2 and the PCI Data Security Standard, either as a contributor or control owner.

• Excellent interpersonal, verbal, and written communication skills with the ability to communicate compliance and privacy related concepts to a broad range of technical and non-technical stakeholders

• Comfort and experience in working in a remote-first organizational, oftentimes asynchronously across many teams and timezones

• Demonstrated success and comfort working with external auditors, outside consultants, and legal affairs

• Experience contributing to and/or managing companywide risk assessments

• Experience and knowledge of cloud service providers and how to interact with them (AWS, Azure, GCP)

What else will help you be successful

• Experience working with databases, developer tools, infrastructure, or other technical products

• Certified Information Systems Security Professional (CISSP) preferred (CISA, or CISM)

• Working knowledge of SQL, preferably with experience in MySQL and/or PostgreSQL

About You You are highly organized and able to operate in a startup environment, comfortable with ambiguous or changing situations. You thrive in an environment of cross-department collaboration and feel comfortable working without organizational silos or barriers. You have a passion to lead programs that directly impact and enable our organization to drive higher levels of success. You understand that security and compliance programs are revenue generators and directly influence our ability to sell to and maintain our most demanding customers.

Yo...