Director, Security & Compliance

Who we are: MHC is a global provider of AI-powered SaaS solutions for document, communication, and payment automation - purpose-built for highly regulated industries. We simplify complexity and unlock intelligence so organizations can deliver exceptional experiences with confidence. Our platform helps enterprise and mid-market organizations improve efficiency, ensure compliance, and modernize customer communications at scale. Customers use MHC solutions to generate more than 10 billion documents and process billions in AP payments annually. Recognized as a Leader in multiple G2 reports and featured in analyst reports from Gartner, IDC, Aspire, and Aragon, MHC is built for organizations that can't afford to get it wrong. People are at the center of everything we do - for our customers and within our own walls. MHC supports a flexible, work-where-you-live model, and for five consecutive years has been named one of Minnesota's Top Workplaces by the Star Tribune, based entirely on employee feedback. We are a team driven to grow, committed to being better than yesterday, and stronger together. We earn trust every day with our customers, our partners, and each other. We experiment boldly, and when our customers win, we win. For more information, visit mhcautomation.com. Who we are looking for: We are seeking a hands-on Director, Security and Compliance to build and own our security, data governance, and AI governance program as we scale. This is a rare "own it end to end" role. You won't be managing a large team or inheriting a mature GRC function. You'll be the single point of accountability for keeping customer trust, data, and AI systems secure and audit-ready, while working shoulder to shoulder with engineering, product, and sales. This role sits at the intersection of three disciplines that are converging fast in AI-native companies: security compliance (SOC 2 and beyond), data governance, and AI governance/risk. You'll set the strategy and also do the work writing policies, running access reviews, managing auditors, and answering enterprise security questionnaires. This is also a certification-critical role. Maintaining our SOC 2 Type II report is a top-priority. What you will get to do: Security & Compliance Program • Own the renewal and continuous operation of our SOC 2 Type II report and serve as primary liaison to our audit firm • Mature the existing control environment: reduce manual evidence collection, tighten scope as new products/systems come online, and keep controls audit-ready year-round rather than sprinting before each renewal • Develop, document, and operate controls that maximize risk mitigation and remain compliant with our target regulatory frameworks (SOC 2 Type II, HIPAA, PCI, GDPR/CCPA), and work directly with auditors to ensure ongoing compliance • Expand our attestation footprint as needed based on customer and market demand (ISO 27001, HIPAA, GDPR/CCPA, or SOC 2 + additional Trust Services Criteria like Privacy) • Serve as the primary point of contact for customer security reviews, questionnaires, and due-diligence requests during the sales cycle • Maintain the company's security policy suite, risk register, and incident response plan; run tabletop exercises Data Governance • Establish data classification, retention, and access-control standards across production systems, data warehouses, and SaaS tools • Partner with engineering to implement least-privilege access, encryption standards, and data lifecycle management • Develop and implement secure software development lifecycle (SDLC) policies in partnership with engineering, along with environmental and physical security standards • Own vendor/third-party risk management, including security review of new SaaS and AI tools before adoption • Assist Legal with customer and vendor contractual negotiations related to security and data privacy obligations AI Governance & Risk • Build the company's AI governance framework: acceptable use policies, model/vendor risk assessment, and oversight of how AI features and internal AI tools handle customer and employee data • Track emerging AI-specific standards (NIST AI RMF, ISO 42001) and translate them into practical, lightweight controls appropriate for our stage • Partner with product/engineering on responsible AI practices for customer-facing AI features (data usage disclosures, model risk review, opt-out mechanisms) • Provide security and compliance input on shadow AI risk — discovery and governance of AI tools used across the company Leadership & Cross-Functional Partnership • Act as a trusted advisor to the executive team and board on security and compliance posture • Partner with Sales and Customer Success as a credible technical voice in enterprise deals • Build out the security/compliance function What Success Looks Like in This Role: • Every SOC 2 Type II audit cycle closes with zero exceptions and no gaps in control coverage between periods • Evidence collection and control monitoring run continuously in the background (via automation tooling) • Enterprise security questionnaires and customer due-diligence requests are turned around quickly and don't bottleneck sales cycles • A documented, living AI governance framework is in place and actually used and new AI tools and features get risk-reviewed before adoption, not after an incident • Data classification, retention, and access-control standards are documented, adopted by engineering, and hold up under audit scrutiny • Executives and the board have a clear, current view of security/compliance position and risk at all times • The security/compliance function scales appropriately as the company grows Knowledge and Skills: • Direct, hands-on experience operating and renewing an existing SOC 2 Type II program including managing annual/ongoing audit cycles • Working knowledge of data governance practices; classification, retention, access review, and privacy regulations (CCPA/GDP