About Syllo
Syllo is leading the Litigation AI category. In 2019, a team of litigators and engineers founded Syllo to redefine how complex litigation works. Today it is the first unified Litigation AI system built to manage the entire case lifecycle, helping legal teams decide what matters and what comes next. Backed by top-tier VCs, Syllo empowers leading law firms and Fortune 500 companies to move faster and mitigate risk. Awarded ILTA Transformative Project of the Year and ALM eDiscovery Technology of the Year for 2026, we deliver enterprise-grade Litigation AI. We’re building a team to push the boundaries of what technology can achieve.
About the role
This role owns Syllo's data security compliance function and reports to the Head of Legal, Security, and Compliance. You ensure that Syllo's processes and policies support our certifications and satisfy the scrutiny of auditors and clients.
You will manage the renewal of Syllo's certifications, including our SOC 2 and ISO 27001 programs, and ensure compliance with internal policies for handling sensitive information. You will develop processes for providing clients key information, including responses to vendor security questionnaires (VSQs). The roles will also require you to define the security and configuration conditions that software must meet before Syllo adopts it for internal use. You will coordinate the response to security issues per policy, and ensure data is handled in a manner compliant with applicable privacy regimes.
This is a role that will require you to develop policies and procedures, sometimes from scratch. You are inheriting a program in progress, not a mature function. You will execute directly today while building and scaling the team over time.
We are looking for someone who has owned compliance programs end to end, not just contributed to ones someone else ran. Judgment, ownership, and the ability to operate at the intersection of legal, technical, and commercial considerations are the core requirements.
This position includes opportunities for growth into product-related security responsibilities and team building as the company continues to mature.
What you will do
Own the compliance program: Manage SOC 2 Type II and ISO 27001 certification cycles end to end: scope, evidence, auditor relationships, and remediation. Ensure Syllo's processes and policies support these certifications. You own the program, not the platform's technical controls.
Run the VSQ process: Own vendor security questionnaire responses across the enterprise sales pipeline. Quality and turnaround time are both metrics.
Build policy infrastructure: Design and maintain data handling policies, disaster recovery plans, and incident response procedures.
Set software acceptance conditions: Define the security and configuration standards software must meet before it enters the Syllo stack. Approve additions against those standards.
Coordinate incident response: When a security issue arises, drive the response per the incident response plan. You coordinate the right owners rather than perform the technical investigation.
Own privacy processes: Ensure data is stored in a manner compliant with applicable privacy regimes, and that processes exist for responding to inquiries made under them. Work consultatively and cross-functionally with engineering on implementation.
Advise cross-functionally: Serve as the compliance voice across operations and commercial conversations.
What you bring
Compliance program ownership: You have built and run SOC 2 and ISO 27001 programs, not just participated in audits someone else managed.
VSQ and audit cycle depth: You have developed process and tools for responding to security questionnaires from enterprise and law firm procurement teams under time pressure.
Policy and DR expertise: You have designed data handling policies, disaster recovery documentation, and incident response procedures that have held up to auditor and customer scrutiny.
Privacy fluency: You…