SOC 2 Compliance for Engineers
Definition
SOC 2 is an attestation report, defined by the AICPA, in which an independent auditor evaluates a company’s controls against the Trust Services Criteria: Security (required), plus optionally Availability, Confidentiality, Processing Integrity, and Privacy. A Type I report covers control design at a point in time; Type II covers operating effectiveness over a period (usually 6–12 months). B2B SaaS deals — including AI products — routinely require a SOC 2 Type II before enterprise customers will sign.
Why it matters for AI jobs
Every AI startup selling to enterprises goes through SOC 2, and engineers carry much of the load: SSO everywhere, least-privilege access with quarterly reviews, PR-based change management, encrypted data, centralized logs, and incident runbooks. Senior engineers who have "been through a SOC 2 audit" and know how to build compliant-by-default pipelines are explicitly sought in job posts mentioning SOC2/compliance.
Key concepts
- Trust Services Criteria — Security/Availability/Confidentiality/Processing Integrity/Privacy.
- Type I vs Type II — design at a point in time vs effectiveness over an observation window.
- Access control evidence — SSO, MFA, role-based access, and quarterly access reviews.
- Change management — code review + CI checks + deploy approvals as auditable controls.
- Logging & monitoring — centralized, retained logs; alerting; incident response records.
- Vendor management — tracking subprocessors (e.g. your LLM API provider) and their reports.
- Compliance automation — platforms like Vanta/Drata that collect evidence continuously.
Learning path
- Read one public SOC 2 primer and one real (redacted) report to see the structure and control language.
- Audit your own project as practice: where would SSO, access review, and change-management evidence come from?
- Implement the engineering backbone on a side project: SSO login, branch protection + required reviews, centralized structured logs.
- Learn one compliance-automation platform’s docs (Vanta or Drata) — they map controls to integrations concretely.
- Prepare interview stories: how you would design a deploy pipeline whose audit evidence generates itself.