Compliance & Trust Lead at Linear, a product development platform. Operate and mature SOC 2 Type II and ISO 27001 certifications, manage risk programs, and embed compliance controls into product development. Partner with engineering and leadership to scale the GRC function with automation.
At Linear, we're building the product development system for teams and agents. AI is fundamentally changing how software gets built, and we’re shaping the tools this new era requires.
Founded in 2019, Linear has become the platform of choice for more than 25,000 companies (including OpenAI, Coinbase, and Ramp) to plan, build, and ship their products. Today, our team is distributed across North America and Europe, and we’re continuing to grow internationally. What unites us is relentless focus, fast execution, and a deep care for software craftsmanship.
At Linear, we hold ourselves to a commitment to quality. To us, security is an essential part of that quality — not a layer that we add later, but something we build in from the start. We have a strong foundation (SOC 2 Type II, ISO 27001, and a security program we're proud of) but as Linear evolves our product and scales into enterprise, there's meaningful work ahead: keeping our compliance program current as we grow and ship fast, deepening the trust we’ve established with customers, and maturing our approach to privacy and risk. As Compliance & Trust Lead at Linear, you'll partner with our Head of Security in a high-autonomy role with real scope, ensuring the bar we set internally is one our customers can verify.
Location & work mode
Linear is a remote-first company, with optional co-working offices in San Francisco, New York, and London. This role is open to candidates based in North America. You can work from anywhere within this region. We value deep focus and async collaboration, with intentional moments to connect in person through team off-sites, optional co-working, and occasional travel.
What you’ll do
Operate and extend Linear's compliance program end-to-end — maintain and mature our SOC 2 Type II, ISO 27001, and other relevant certifications (roadmap: ISO 27701, ISO 42001) while keeping audit overhead low and evidence collection as automated as possible
Be the primary point of contact for security questionnaires, customer trust reviews, and enterprise procurement conversations — turn what's often a bottleneck into a competitive advantage
Run our risk management program — identify emerging risks across the product, infrastructure, and vendor landscape, drive remediation with the right owners, and surface clear signal to leadership
Partner closely with engineering to embed compliance controls into how we build — shape policy and tooling so security requirements land early in the development process, not as a retrofit
Manage our third-party risk program — evaluate vendors and subprocessors, maintain our inventory, and ensure our supply chain meets the bar we hold ourselves to on both security and privacy
Help scale the GRC function with automation — reduce manual toil, build durable processes, and ensure the program grows with the business without linearly growing headcount
What we’re looking for
A seasoned GRC practitioner — you have 7+ years in compliance and customer trust, ideally in a B2B SaaS or developer tools environment, and you've seen enough audit cycles to know where the sharp edges are
Framework-fluent and privacy-aware — you have deep hands-on experience with SOC 2 and ISO 27001, understand how privacy regulations like GDPR and CCPA intersect with security controls, and can reason about new frameworks from first principles
A builder, not just an operator — you see manual compliance work as a problem to be designed away, default to scalable processes over manual workflows, have used tools like Vanta, Drata, or similar platforms to do it
A trusted partner, internally and externally — you work fluidly with engineering, legal, and customers alike; you can explain a control design to a skeptical customer, draft a crisp policy, and write a risk summary leadership will actually read
Autonomy-oriented — you're comfortable operating with significant independence, setting your own priorities, and knowing when to loop in leadership, without needing to be managed closely
Pragmatic over procedural — you optimize for reducing real risk, not checking boxes, and you know the difference
Tools & environment
This role sits close to the product and infrastructure we build. You don't need to be an engineer, but you should be comfortable navigating technical systems and working directly with the teams that build them. Our stack runs on Google Cloud with k8s, Postgres, and Node — understanding how it's put together matters for scoping controls and audits.
For day-to-day work, we use:
Linear, GitHub, Slack, and Google Workspace for collaboration
Claude and ChatGPT for general AI tasks
Vanta for compliance automation and evidence collection
What we offer
We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect:
Competitive salary and equity
Employee-friendly equity terms including early exercise in the US and extended exercise windows
Daily meal and coffee stipend on every workday
Paid co-working space or desk
Health coverage (based on country requirements)
5 weeks paid vacation, plus local statutory holidays
4 months paid parental leave
Paid month off after 4 years & every 2 years thereafter
Regular team events and off-sites
Remote-first with no required commute
Learn how we think & work
A story about our mission: Read Me
Our hiring process: How we hire at Linear
How we work: Designing remote work at Linear
Our high level security features: Safe, secure, and private
Our customer-facing trust content: Linear’s Trust Center
Outcomes of a recent incident: Post mortem on Linear security incident on March 24th, 2026
A video series: Conversations on Quality
Building our teams: Why and how we do work trials at Linear
Our recent Series C Fundraise and Giving our team liquidity
Linear is an equal opportunity employer. We do not discriminate based on race, color, religion, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law.