Compliance Manager

About Coval

Coval is the evaluation platform for enterprise voice AI, built by former Waymo engineers applying autonomous vehicle testing standards to help companies deploy and scale conversational agents to 10s of millions of calls a month. The platform gives engineering, product, QA, and operations teams the infrastructure to stress-test agents across millions of realistic scenarios before launch, monitor every live conversation in production, and continuously sharpen performance through human-in-the-loop review. Trusted by more than 60 customers like Chime and Zoom, Coval is the operations layer for voice interfaces.

The role

We're looking for a Compliance Manager to own security and compliance at Coval end to end. Our customers are enterprises in healthcare, fintech, and insurance, so trust is part of the product: every deal runs through a security review, and every new framework we hold opens another set of doors. We already hold SOC 2 and HIPAA, and PCI DSS and ISO 27001 are in process. You will own all of them, plus the audits and the procurement questionnaires and security reviews that come with enterprise sales.

You'll be the person who keeps the whole program moving. Our compliance platform surfaces a steady stream of alerts and findings, and today they land on engineers who should be doing deeper security and product work. You'll take that load: triage every flag, fix the ones you can handle yourself, and hand the rest to the right engineer with clear context so it gets done. You'll be technical enough to make real changes and to know when something needs an engineer, and organized enough to run several audits and a steady flow of customer requests without anything slipping.

What you'll do

Own our compliance frameworks

Own the SOC 2 and HIPAA programs day to day, and drive PCI DSS and ISO 27001 from in-process to certified. Keep policies, procedures, and the risk register accurate to how we actually operate, and make sure the controls our platform maps across frameworks are actually implemented and evidenced. Take on new frameworks as customer demand grows (for example ISO 42001 or other AI-specific standards), with a clear view of which ones are worth the investment.

Run audits to successful outcomes

Manage auditors, assessors, and the audit calendar for every framework: scoping, readiness, fieldwork, and remediation. Keep the program audit-ready year round instead of scrambling at fieldwork, with controls tested continuously and gaps tracked to closure.

Manage our compliance platform and the alerts it raises

Own our compliance platform (Oneleet) and triage every alert and failing control, deciding what's urgent, what's noise, and what needs a change. Fix what you can directly: access and identity settings, device and policy gaps, vendor and HR items, documentation, and straightforward cloud or configuration changes. For anything that needs deeper engineering or security work, write a clear Linear ticket with the control, the risk, and the evidence needed, route it to the right engineer, and follow it to closure. Collect and organize audit evidence, and automate the repetitive pieces, such as access reviews and vendor reviews, with the platform and simple scripts where it makes sense.

Own security reviews and procurement questionnaires

Own the intake and turnaround of customer security questionnaires, security reviews, and vendor risk assessments, working with Sales so they don't stall deals. Maintain our compliance knowledge base and answer library so responses are accurate, consistent, and quick, and pull in engineers only for questions that truly need them. Join customer security calls when a prospect's team wants to go deeper, and feed recurring customer asks back into which controls, frameworks, and documents we prioritize next.

Work across the company

Partner with Engineering, Product, People, and Legal to implement controls that are minima