Staff/Principal Compliance Manager
Generate a McCoy IQ challenge in 30 seconds.
See how candidates think and approach the work this role demands, before the phone screen. We'll build a video challenge from this posting, and you can edit or share it before it goes live.
Key details
Job Description
Join the Future of Security at Netskope
Netskope (NASDAQ: NTSK) is a leader in modern security and networking for the cloud and AI era. We secure and accelerate cloud, data, and AI in real time, everywhere. Thousands of customers, including more than 30 of the Fortune 100, trust the Netskope One platform, its Zero Trust Engine, and the powerful NewEdge network to gain full visibility and control without performance trade-offs.
At Netskope, our technology is driven by our greatest strength: our people. We believe that belonging powers innovation, and success is both personal and organizational. We embrace differences in gender, ethnicity, beliefs, ability, and identity, creating an environment where every voice is heard and respected. We empower our employees to bring their authentic selves to work, grow their careers through continuous education and mentorship, and lead with transparency and curiosity. Join a team where you belong, where you are encouraged to be an entrepreneur, and where together, we continue to redefine the landscape of security.
Visit Careers at Netskope to learn more. Follow us on LinkedIn and Instagram.
About the position:
Netskope is seeking a Staff/Principal Compliance Manager to join the Global Information Security (GIS) Governance, Risk & Compliance team as our EU Regulatory and Sovereignty lead. You will work closely with the CISO, the Global GRC Officer, Privacy, Legal, Compliance Product Management, and the EMEA sales organization to keep the Netskope platform aligned with EU and UK regulatory, security, and data sovereignty requirements, and to help customers understand how Netskope supports their own compliance obligations.
This is a customer-facing role. You will be a trusted voice in conversations with customer CISOs, senior security leadership, and third-party vendor risk management teams across Europe, explaining both how Netskope meets these requirements as a provider and how customers can use their Netskope deployment to meet them. The role is based in Spain, with periodic travel across the EU and UK.
Responsibilities:
EU REGULATORY & SOVEREIGNTY PROGRAM
- Control and regulatory mapping. Build and maintain mappings between Netskope’s control framework (ISO 27001/27017/27018/27701, SOC 2, CSA STAR) and EU and UK regulatory requirements, including DORA, NIS2, the EU Cyber Resilience Act (CRA), the EU AI Act, GDPR and member-state privacy laws, and the EU Data Act, so a single control set evidences many obligations.
- DORA. Support Netskope’s posture as an ICT third-party service provider to EU financial entities: contractual requirements, customer audit and access rights, incident notification support, exit and resilience provisions, and customer register-of-information requests.
- Cyber Resilience Act. Partner with Product Security and PSIRT on CRA readiness, including vulnerability handling, actively exploited vulnerability and severe incident reporting, SBOM practices, and conformity assessment preparation for in-scope Netskope products such as endpoint clients and appliances.
- EU AI Act. Support AI governance for Netskope’s AI-enabled features: AI inventory, risk classification, transparency obligations, and alignment with ISO/IEC 42001, tracking phased obligations and amendments as they take effect.
- Data and service sovereignty. Partner with Product, Platform Engineering, and Privacy to document how Netskope’s NewEdge data centers, data processing, storage, and metadata handling meet EU and member-state sovereignty and residency expectations; maintain accurate customer-facing sovereignty documentation, data-flow descriptions, and sub-processor information.
- BSI C5. Own Netskope’s C5 attestation, including the move to C5:2025, which aligns with EUCS and NIS2 and is increasingly used as a cloud security benchmark beyond Germany; track its evolution toward broader EU adoption.
- National and sector schemes. Support alignment with other national and emerging EU schemes as needed, including Spain’s Esquema Nacional de Seguridad (ENS), France’s SecNumCloud, and the EU Cybersecurity Certification Scheme for Cloud Services (EUCS).
- Regulatory change. Track guidance from the European Commission, ENISA, the EDPB, and national authorities (e.g., AEPD, CCN-CERT, NCSC); translate changes into gap assessments, owners, and remediation plans.
UK & EU AUDITS AND CERTIFICATIONS
- Audit execution. Lead or support external audits and assessments for UK and EU frameworks, including ISO 27001/27017/27018, BSI C5, Cyber Essentials Plus, UK Ministry of Defence requirements (e.g., DEFSTAN 05-138 and the Defence Cyber Protection Partnership Cyber Security Model), and ENS.
- Evidence, interviews, and findings. Validate evidence for completeness, accuracy, and currency; prepare control owners and participate in auditor interviews; triage findings and nonconformities and track remediation to closure.
- Customer and regulator-driven audits. Coordinate customer audits and on-site or remote assessments, including those exercised under DORA and NIS2 supply-chain requirements.
CUSTOMER & SALES ENABLEMENT
- Trusted advisor. Partner with EMEA sales and sales engineering on customer engagements, clearly communicating with CISOs, security leadership, DPOs, and third-party vendor risk management teams on how Netskope meets EU regulatory and sovereignty requirements.
- Platform and deployment expertise. Explain the Netskope One platform (SWG, CASB, ZTNA, DLP, FWaaS, SD-WAN, and AI security) and its EU deployment: data flows, processing locations, residency options, tenant configuration, and the shared responsibility model.
- Customer compliance outcomes. Help customers map Netskope capabilities to their own obligations under DORA, NIS2, GDPR, the AI Act, and sovereignty requirements (e.g., DLP for personal data, ICT third-party and SaaS risk visibility, and generative AI governance) and guide implementations that support those outcomes.
- Due diligence and enablement. Own EU-focused RFP responses, security questionnaires, DORA and NIS2 supplier assessments, and DPA/security schedule reviews with Legal and Privacy; build reusable content, FAQs, and training so EMEA sales teams can lead first-line compliance conversations.
COLLABORATION
- Partner with Privacy, Legal, Compliance Product Management, Engineering, PSIRT, Corporate IT, and Sales to build EU and UK regulatory requirements into products and processes; exercise independent judgment based on risk to Netskope, raise risks proactively with recommendations, and mentor junior team members.
Requirements:
- 8+ years in security compliance, GRC, audit, or regulatory advisory, ideally with a SaaS, cloud, or security provider or a Big Four advisory practice.
- Strong working knowledge of DORA, NIS2, GDPR, the Cyber Resilience Act, the EU AI Act, ISO 27001, and BSI C5; hands-on experience with Cyber Essentials Plus and UK MOD requirements, and a proven ability to map framework controls to regulatory requirements.
- Solid understanding of cloud and network security architectures; SSE/SASE experience strongly preferred.
- Excellent written and verbal communication, with confidence presenting to senior security leadership and vendor risk teams in plain language.
- Fluent English and Spanish; an additional EU language (e.g., French, German, Italian) is a plus.
- Relevant certifications preferred: ISO 27001 Lead Auditor or Lead Implementer, CISSP, CISM, CISA, CCSP, CIPP/E, or ISO/IEC 42001.
- Right to work in Spain and ability to travel within the EU and UK as needed.
#LI-NN1
Compensation:
At Netskope, salary is one component of our competitive total rewards package. The salary range for this position is as listed below, and applies to candidates based in European Union (EU) member states, in local currency. This range is provided in accordance with EU pay transparency requirements.
The successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, location, and market conditions.
For all sales roles, the posted salary range is the On Target Earnings (OTE) range for the role, which is the sum of base salary and target commission amount at 100% goal achievement.
In addition to salary, candidates may be eligible for other forms of compensation such as participation in a bonus plan (for non-sales roles) and a stock award program. Candidates may also be eligible for a comprehensive health plan and other benefits that can be reviewed upon request.
Netskope is committed to implementing equal employment opportunities for all employees and applicants for employment. Netskope does not discriminate in employment opportunities or practices based on religion, race, color, sex, marital or veteran statues, age, national origin, ancestry, physical or mental disability, medical condition, sexual orientation, gender identity/expression, genetic information, pregnancy (including childbirth, lactation and related medical conditions), or any other characteristic protected by the laws or regulations of any jurisdiction in which we operate.
Netskope respects your privacy and is committed to protecting the personal information you share with us, please refer to Netskope's Privacy Policy for more details.
The application window for this position is expected to close within 50 days. You may apply by filling out the below information, or visiting our Netskope Careers site.
