Compliance and Security Lead

About Us Ada is an AI customer service company whose mission is to make customer service extraordinary for everyone. We're driven to raise a new standard of quality customer service at scale, enabling enterprise companies to deliver experiences that people love–instant, proactive, personalized, and effortless. Ada is an AI transformation platform and partner—combining strategic expertise with powerful AI agent management technology to accelerate businesses’ AI maturity to keep them ahead of the curve. With Ada, 83% of customer conversations—and counting—are effortlessly resolved through automation, giving teams more time back, companies more resources to focus on growth, and customers more life to focus on what matters most to them. Established in 2016, Ada is a Canadian company that has powered over 5.5 billion interactions for leading brands like Square, YETI, IPSY, and Monday.com , saving millions of hours of human effort. Backed with over $250M in funding from tier-one investors including Accel, Bessemer, FirstMark, Spark, and Version One Ventures, Ada is a pioneer in the management and application of AI in customer service. At Ada, we see growth as a reflection of each individual owner’s personal growth. That’s why our values are rooted in driving progress and continuous improvement. If you’re ambitious and eager to grow, Ada could be the place for you. Learn more at www.ada.cx . Security at Ada Ada's AI Agent resolves customer service conversations for enterprises — which means our customers trust us with their customers' data and their brand. Security and compliance are how we earn and keep that trust. The Security team partners across engineering, legal, and go-to-market to make sure Ada's controls are real, evidenced, and easy for customers to verify. Our Role As Compliance & Security Lead, you own Ada's security compliance program end to end: audits, customer trust, vendor risk, vulnerability management, and the control framework that ties it all together. Our audit season runs August through November — your mandate is to automate evidence collection and process to the point where the team is audit-ready year-round, not scrambling seasonally. You are the internal source of truth on compliance status and the external face of Ada's security posture: you will own security conversations with enterprise prospects and customers. As agentic AI regulation takes shape (starting with AIUC), you translate framework movement into concrete requirements for the platform team. About You - Deep audit experience across SOC 1, SOC 2, PCI DSS, NIST frameworks, AICPA standards, and PII/privacy requirements. You have run audits end to end: evidence collection, control mapping, and auditor coordination. - Experience working directly with major audit firms such as Deloitte or EY; you know what a gold-standard audit engagement looks like from the inside. - You have inherited manual compliance programs and driven them toward automation tooling, process, and repeatability (Drata or similar compliance automation platforms). - Vulnerability management at scale: you have taken a large vulnerability backlog (thousands of findings) and driven it down through prioritization, ownership, and process. - Customer-facing confidence: you own the room in security posture conversations with enterprise prospects, and you are equally comfortable saying "let me get back to you" and then actually getting back to them. - An engineering background is preferred but not required; you must understand modern infrastructure, Kubernetes, Terraform, CI/CD! well enough to hold your own with engineers and auditors alike. - Experienced owner of RFP security sections, customer security questionnaires, and trust centers (SafeBase or similar). - Strong writer: policies, control documentation, and data handling standards that people actually follow. - Proactive owner who builds programs that outlast you: process, documentation, and tooling ove