Commercial Compliance Lead
This is the employer's own posting, not a copy on a job board.
What we know
Is it still open?
Confirmed still open
Last checked just now — checked against the employer's own applicant tracking system, which is the company answering directly.
We re-read the employer's own applicant tracking system and the posting was still there. That is the company answering directly.
How old is it?
Posted 2h ago
The date the source published, not the day we noticed it (2026-11-03). Last seen at its source just now.
Is it remote?
Marked remote on the employer's board
Their board carries a remote setting on this posting — a field they filled in, not wording we read. The location field names somewhere specific, which is usually where the team or the entity sits.
Who may apply?
United States
The description agrees: it names United States.
What the ad says
…Location: Remote (US), with regular travel to Factory offices required…
…Remote (…) US…
Pay not stated
Similar roles pay $141.8k–215k/yr
Middle 50% of 33 listings that do state pay — Legal & Compliance · Lead · United States · USD/year. This employer has published no salary; this is what comparable listings we hold disclose, never converted between currencies or periods. How this is calculated.
Skills named in the ad
Recognised terms only, from a fixed vocabulary — this is what CV matching compares against.
Carried by 1 source
-
Ashby employer's own board first seen just now · last seen just now
The listing
About Factory
Our mission is to create a world where software builds and improves itself.
We build the platform for self-improving software development, helping the world's largest enterprise engineering teams turn their organizations into autonomous software factories. Customers including Nvidia, Blackstone, Royal Bank of Canada (RBC), Palo Alto Networks, Adobe, and T-Mobile run Factory to ship code, review PRs, run tests, and deploy continuously - getting smarter with every cycle.
In 2026, we raised $200M at a $5B valuation, bringing our total funding to over $400M. We are backed by world-class investors and operators including Khosla Ventures, Sequoia, Blackstone, Ali Ghodsi (CEO of Databricks), and Frank Slootman (Former CEO of Snowflake).
About the Role
Factory is looking for a Commercial Compliance Lead to build and run our commercial compliance program from the ground up. As we sell to some of the most regulated enterprises in the world, across healthcare, financial services, insurance, and automotive, you will make sure every enterprise deal meets its regulatory, security, and contractual requirements while keeping deals moving. You will partner closely with our Enterprise sales team, Deal Desk, Legal, Engineering, and Security, and work alongside our Federal Compliance Lead, who owns public sector compliance. You will own the policies, processes, and guidance that let Factory sell to regulated industries with confidence. This is an individual contributor role on the Legal team.
What you will do and achieve
Build Factory’s Commercial Compliance Architecture: Design, implement, and maintain the enterprise sales compliance program from the ground up, establishing policies, standard operating procedures, and monitoring mechanisms for deals in highly regulated industries like healthcare and finance.
Accelerate Factory’s Enterprise Transactions: Partner directly with Enterprise Account Executives and Deal Desk from opportunity qualification through deal closure. Review customer security questionnaires (CAIQ, SIG), RFPs, and RFQs for compliance obligations, Business Associate Agreement (BAA) terms, and contractual risk.
Meet Statutory and Regulatory Standards: Ensure comprehensive compliance with HIPAA/HITECH for healthcare verticals, the Digital Operational Resilience Act (DORA) for financial sectors, and overarching Information and Communication Technology (ICT) third-party risk management frameworks.
Bridge Factory’s Product, Security, and Commercial Standards: Partner closely with Engineering and Security to align the product roadmap with enterprise certifications and regulatory requirements, including SOC 2 Type II, ISO/IEC 27001, NIST CSF, and DORA's technical resilience and incident reporting mandates.
Govern Third-Party & Supply Chain Risk: Administer the company-wide vendor risk management program, managing ICT sub-outsourcing rights, subprocessor security assessments, continuous compliance monitoring, and audit rights for critical service providers.
Monitor Emerging Commercial AI Policy: Track global AI governance directives (including the EU AI Act, NIST AI RMF, and industry-specific AI guidelines) and data privacy mandates, translating evolving policy into actionable operational guidance for commercial teams.
Build Compliance Agents and Workflows: Automate as much of the day to day compliance work as possible to leverage your strategic insights
Qualifications
Commercial Enterprise Expertise: 6+ years of hands-on experience in regulatory compliance, third-party risk management (TPRM), or commercial sales operations at an enterprise SaaS, cloud platform, or high-growth B2B technology company.
Mastery of Commercial Regulations: Deep working knowledge of HIPAA/HITECH, EU DORA, ICT supply chain governance, and commercial contracting practices, including Data Processing Agreements (DPAs), BAAs, and specialized regulatory schedules.
Cloud & AI Compliance Literacy: Proven track record operationalizing compliance frameworks for cloud software, including familiarity with SOC 2, ISO 27001 readiness, and modern compliance automation platforms.
A Builder Mindset: You are excited to build a compliance program from scratch, comfortable operating in high-velocity, ambiguous environments, and proactive about finding scalable solutions that enable sales momentum.
Crisp Cross-Functional Communication: Exceptional ability to synthesize dense regulatory requirements into clear guidance for sales executives, software engineers, corporate counsel, and enterprise CISOs or compliance officers.
Professional Credentials: Holding active industry governance and privacy certifications such as CIPP/US, CIPP/E, CRISC, CISA, or HCISPP is highly preferred.
Location: Remote (US), with regular travel to Factory offices required.