Jobs › SOC 2
SOC 2 Compliance Jobs
SOC 2 is the AICPA's trust and security attestation, the standard SaaS and cloud companies use to prove their controls to customers.
SOC 2 is an attestation report, defined by the AICPA's Trust Services Criteria, that tells customers an organization's controls over security, and optionally availability, processing integrity, confidentiality, and privacy, are designed and operating effectively. A Type I report assesses design at a point in time, a Type II report assesses operating effectiveness over a period, usually three to twelve months. It is not a law, but for B2B software and cloud companies it has become the price of doing business, the report a prospect's security team asks for before signing.
Because almost every SaaS company needs one, SOC 2 readiness and audit work is one of the highest-volume entry points in GRC. The roles run from building the control environment and evidence collection to managing the audit and the auditor relationship, and they are a common on-ramp to broader security-compliance and GRC careers.
SOC 2: Frequently Asked Questions
What is SOC 2?
SOC 2 is an attestation report based on the AICPA Trust Services Criteria that demonstrates an organization's controls over security and, optionally, availability, processing integrity, confidentiality, and privacy are effective.
What is the difference between SOC 2 Type I and Type II?
Type I assesses whether controls are suitably designed at a point in time. Type II assesses whether they operated effectively over a period, typically three to twelve months.
Is SOC 2 required by law?
No. SOC 2 is voluntary, but it is effectively required by customers in B2B software and cloud, where security teams request it before purchasing.
Open SOC 2 GRC jobs (74)
GRC Engineer
Consulting Associate/Cybersecurity & Incident Response (Forensic Services practice)
Information Security Analyst (f/m/x)
Associate Principal/Cybersecurity & Incident Response (Forensic Services practice)
Client Assurance Analyst (Security Questionnaires)
Senior Security Analyst
Associate/Cybersecurity & Incident Response (Forensic Services practice)
Associate Principal/Cybersecurity & Incident Response (Forensic Services practice)
AI Security Engineer
Security Engineer, Corporate Security
Security Engineer
Consulting Associate/Cybersecurity & Incident Response (Forensic Services practice)
Senior Security Engineer - End-User, Infrastructure & AI Security
Lead Senior Security Engineer (Enterprise AI Platform)
GRC Engineer
GRC Manager
Director of Security Assurance & Trust
Director of Security Assurance & Trust
Director, Governance Risk & Compliance
Senior Compliance Program Manager, GRC
GRC Engineer
GRC Engineer
Compliance Manager
Director, Application & AI Security
Senior Compliance Analyst, Customer Trust
Senior Compliance Analyst, Governance Programs
Product Manager, Enterprise Privacy
Security GRC Program Manager, Third Party Risk
Security Audit & Controls, Security GRC
Third-Party Risk Management (TPRM) Risk Analyst
Staff Security Governance Engineer, Policies & Standards
Senior GRC Specialist
Supplier Security & Assurance, Security GRC
GRC Manager
GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager
Technology and Security Risk Director
IT Risk Manager, BT Risk Management
Security Risk & Compliance, Data Centers & Compute
Sr. GRC Engineer
Senior Engineering Manager, SDET - Okta Identity Governance (OIG)
Third Party Risk Management Lead
Lead Security Compliance Engineer
GRC Principal - Data Privacy and Security
Associate General Counsel, Privacy – Remote (USA) (993-SLS)
Senior Risk Analyst
Senior Risk & Governance Engineer
Compliance Engineering Lead
Head of Privacy & Security
Senior Risk Associate
Staff Identity Governance and Access Engineer
Staff Software Engineer, AI and Data Risk
Vendor Risk Manager
Security & Compliance Lead
Staff Software Engineer, AI and Data Risk
Director of Product, Governance & Compliance
Lead, Security Controls Assurance - SOX
Subject Matter Expert, GTM GRC - V4G
Security & AI Governance Lead
Senior Third-Party Risk Specialist
Technical Audit Manager - CSO CTO (f/m/x)
Security Compliance Specialist
GRC Pre-Sales Consultant / Solutions Engineer – EMEA
GRC Program Manager, Audit & Controls
Director of Cybersecurity Governance, Risk and Compliance
Internal Audit Manager
Senior Manager, Information Compliance, AI Governance & Privacy
Senior Privacy Counsel
Governance, Risk & Compliance Analyst
Virtual CISO & Cybersecurity Practice Lead
Head of Security & AI Governance
Director, Compliance & AI Governance
Governance, Risk & Compliance (GRC) Analyst
Sr Manager, Governance, Risk, Compliance & Privacy
Security Engineer, GRC
SOC 2 jobs: what the market looks like right now
A snapshot built from the 74 SOC 2 roles currently on this page.
What these roles pay by level
| Level | Median midpoint | Postings |
|---|---|---|
| Mid-level | $185k | 7 |
| Senior / lead / manager | $155k | 12 |
| Director | $235k | 5 |
How these figures were calculated, and sources
Primary source: our own board. Every figure above is the median midpoint of the salary ranges published in the live postings on this page. Nothing is estimated, modeled, or carried over from a previous month. It is recalculated each time the board refreshes.
What is included. Only postings that publish a salary range. Hourly, weekly and monthly rates are annualised (2,080 hours, 52 weeks, 12 months). Ranges below $20,000 a year are excluded as data-entry placeholders. A seniority band is shown only when at least five postings support it; executive / c-suite is present on this page but below that threshold, so no median is published for that band.
What this is not. These are advertised ranges, not accepted offers. Advertised ranges tend to run wider than what is actually paid, and roles that do not publish a range are missing from the calculation entirely, which can bias the result upward.
For an independent benchmark, compare against the U.S. Bureau of Labor Statistics Occupational Employment and Wage Statistics for SOC 13-1041 — Compliance Officers, published annually at bls.gov/oes. BLS reports actual wages across all employers rather than advertised ranges, so its medians normally sit below job-board figures.
Where the work is
- Work mode: 16 remote, 1 hybrid, 57 on-site or unstated.
- Seniority mix: senior (35), mid (27), director (8), executive (4)
- Employers hiring more than one: Charles River Associates (5), Anthropic (5), Vanta (5), AlphaSense (4), Deutsche Bank (2), Cape Cod Community College (2)
Skills these postings ask for
- board and committee reporting
- policy lifecycle ownership
- risk appetite and tolerance setting
- three-lines-of-defense operating models
- ISO/IEC 42001 and NIST AI RMF fluency
How to get a governance job — the full career guide for this field: entry routes, transferable backgrounds, certifications and salary by level.
Certifications that come up most
None of these are universally required, but they appear often enough in SOC 2 postings to be worth knowing: CGEIT, CRISC, AIGP, CISA. The certification academy covers what each one actually tests and who it is for.
Hiring for SOC 2?
We have 74 open SOC 2 roles on the board right now. Reach candidates who are already searching for this role, not a general audience. Your posting appears on this page, in the job alerts, and across the GRC Careers network.
Post a job Pricing from $99 · About GRC Careers · Hiring toolkit
All GRC jobs · Job alerts