Quality Management System (QMS) Manager – Engineering Operations At SailPoint, we do things differently. We understand that a fun-loving work environment can be highly motivating and productive. When smart people work on intriguing problems, and they enjoy coming to work each day, they accomplish great things together. With that philosophy, we've assembled the best identity team in the world that is passionate about the power of identity. As the fastest-growing, independent identity governance (IGA) provider, SailPoint helps hundreds of global organizations securely and effectively deliver and manage user access to data and applications residing in the data center, on mobile devices, and in the cloud. The company's innovative product portfolio offers customers an integrated set of core services including identity governance, provisioning, and access management delivered on-premises or from the cloud (IAM-as-a-service). SailPoint is seeking a Quality Management System (QMS) Manager to join our Engineering Operations team. This is a customer-facing, highly visible role at the intersection of process governance, multi-framework compliance readiness, and continuous improvement. You will keep the QMS audit-ready, aligned to how teams actually deliver, and connected to engineering tooling that produces evidence. The goal is a living system embedded in real workflows, not documentation revived before each audit.
The Role This is a highly visible, customer-facing role responsible for the successful execution and evolution of our SaaS quality management system. You will be: The central owner of QMS policies, procedures, and records, with clear versioning, ownership, and review cadence. The primary interface between Engineering, Product, Operations, and Compliance for audit readiness and trust communications. Embedded with Engineering leaders to align delivery workflows with control
requirements and audit expectations. Accountable for strengthening the link between engineering tooling and audit posture, reducing manual evidence effort over time. SailPoint's named quality management representative for GxP-regulated and life-sciences customers who require an independent, auditable vendor quality function. Day to Day Own QMS maintenance and governance by keeping policies, procedures, and records aligned to real delivery practices. Coordinate evidence collection and control mapping across annual certification and attestation cycles. Pull and validate evidence from systems of record including Jira, CI/CD, ticketing systems, and access logs. Run internal audit cadence and track findings through closure. Manage corrective and preventive actions (CAPA), including root-cause analysis for recurring issues. Train teams on process changes and audit expectations, and report quality posture to leadership and customer-facing stakeholders. Support EMEA life-sciences deals by producing vendor qualification artifacts and engaging directly on customer quality audits. To be successful in this role you must: Bring strong process discipline balanced with pragmatism so systems improve without slowing teams down. Communicate clearly across technical and leadership audiences and represent quality posture in high-visibility customer discussions. Have hands-on fluency with engineering and observability tooling, including Jira, Confluence, CI/CD, and access systems. Be highly organized and able to coordinate outputs and timelines across multiple partner teams.
Responsibilities: Maintain and govern the QMS, including policy, procedure, and record ownership with defined review cadence. Drive readiness and audit coordination across SOC 2, ISO 27001/27017/27018/27701, CSA STAR Level 2, C5 Type 2, TISAX AL3, FedRAMP Moderate, IRAP, and GovRAMP. Lead the ISO 9001 certification program scoped to software development and release management, closing the GxP vendor qualification gap for life-sciences customers. Operate the evidence and control environment by validating evidence quality and improving traceability. Run internal audit and CAPA programs end-to-end, ensuring findings are addressed and recurrence is reduced. Drive continuous improvement by using metrics, nonconformance trends, and retrospectives to evolve the QMS. Partner with GRC, Security, and customer-facing teams to support external trust and assurance requests.
Requirements: 10+ years of experience maintaining a QMS in a software or SaaS environment. Hands-on evidence and audit coordination experience in one or more of SOC 2, ISO 27001 family standards, CSA STAR, C5, TISAX, FedRAMP, IRAP, or GovRAMP. Working fluency with engineering and observability tooling (e.g., Jira, Confluence, CI/CD, access systems). Strong process discipline balanced with pragmatism. Clear cross-functional communicator comfortable with engineering, leadership, and customer-facing audiences. Desired
Qualifications: Direct experience supporting multiple frameworks including ISO 27001/27017/27018/27701, CSA STAR Level 2, C5 Type 2, TISAX AL3, FedRAMP Moderate, IRAP, and GovRAMP. ISO 9001 certification program experience, ideally scoped to software development and release management in a SaaS environment. Exposure to GxP, GAMP 5, or life-sciences vendor qualification
requirements. Exposure to evidence automation or GRC tooling. Background partnering with GRC or security functions. Hands-on experience using AI-assisted and agent-orchestrated workflows to accelerate planning, tracking, and communication across complex, multi-team programs, with sound judgment about when automation helps and when human oversight is required. Proven ability to design and maintain program tracking in Jira and Confluence that drives accountability and executive-ready visibility. Roadmap for Success By 30 days — Discovery & Assessment: Conduct 1:1s with key stakeholders across Engineering, Product, Compliance, and EMEA commercial leadership to map the quality and GxP landscape. Establish SailPoint's named Quality Management Representative designation — internal and customer-facing — to address immediate vendor qualification requests from life-sciences accounts. Complete a QMS document inventory in Confluence (policies, procedures, records), including owners, review cadences, and gaps versus actual engineering practice. Take ownership of the stalled ISO 9001 gap assessment and schedule kickoff with the incumbent auditor (Coalfire or equivalent). Inherit the 2026 QMS annual review program (ISCREGCOM) and assess status of in-flight document review tasks. Review active audit and certification cycles (SOC 2, ISO 27001 family, FedRAMP, etc.) to baseline current evidence collection pain points. Map the GxP opportunity tracker and identify Tier 1 at-risk accounts requiring immediate quality engagement. By 90 days — Planning, Governance & Early Execution: Deliver a QMS Health Assessment covering current state versus ISO 9001:2015 (scoped to product development and release management), with a gap severity matrix, control-to-evidence map, and 90-day execution plan approved by Eng Ops and Compliance. Finalize scoped certification statement of applicability and remediation plan sequenced toward a 6–9 month ISO 9001 target. Launch the internal audit program and stand up CAPA tracking in Jira with aging dashboards visible to leadership. Complete or accelerate the 2026 QMS annual review with ISO 9001 clause traceability on reviewed documents. Publish GxP Vendor Qualification Pack v1 for Sales/SE, including quality overview, SDLC summary, AWS shared-responsibility inheritance, and named quality contact. Engage directly on Tier 1 at-risk GxP accounts to understand vendor qualification checklists and deliver tailored responses. Build an evidence collection playbook mapping top controls to systems of record (Jira, CI/CD, Confluence, ServiceNow, access logs). Schedule or complete Stage 1 (documentation/readiness) audit with the certification body. Establish a monthly quality posture report for Eng Ops leadership covering audit status, CAPA aging, ISO 9001 progress, and GxP account support. By 6 months — Audit Readiness & GxP Framework: Close critical ISO 9001 gap remediations and advance toward Stage 2 certification audit readiness. Formalize procedures for change control, release governance, internal audit, CAPA, and management review aligned to ISO 9001 Clauses 8, 9, and 10. Deliver GAMP 5 alignment documentation v1 mapping SailPoint SDLC controls to life-sciences vendor qualification expectations. Produce AWS inheritance package documenting how SailPoint leverages AWS ISO 9001 certification and AWS Artifact evidence per the GxP Compliance Framework. Run at least one full internal audit cycle and demonstrate CAPA backlog trending toward closure. Pilot evidence automation for high-effort manual controls, reducing collection time for recurring certification cycles. Deliver account-specific quality responses for top at-risk EMEA opportunities and partner with commercial leadership to tag GxP as a loss/risk reason in Salesforce. Conduct QMS awareness training for Engineering managers on audit expectations, CAPA participation, and quality embedded in delivery workflows. By 1 year — Certify, Sustain & Extend: Achieve scoped ISO 9001:2015 certification for software development and release management processes. Operate the QMS as a living system — clean audit and certification cycles across existing frameworks with no avoidable evidence gaps or last-minute scrambles. Sustain internal audit cadence and CAPA program with measurable process adoption across partner teams. Expand evidence automation to cover the majority of recurring control evidence, materially reducing manual effort. Advance GAMP 5 and 21 CFR Part 11 positioning for the most demanding life-sciences customers, with a clear roadmap for full pharmaceutical-grade QMS if life sciences is confirmed as a strategic vertical. Serve as the durable quality function for customer audits, vendor qualification, and trust communications — converting the GxP compliance gap from a revenue blocker into a competitive advantage. SailPoint is an equal opportunity employer and we welcome everyone to our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status. SailPoint is an equal opportunity employer and we welcome all qualified candidates to apply to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law. Alternative methods of applying for employment are available to individuals unable to submit an application through this site because of a disability. Contact [email protected] or mail to 11120 Four Points Dr, Suite 100, Austin, TX 78726, to discuss reasonable accommodations. NOTE: Any unsolicited resumes sent by candidates or agencies to this email will not be considered for current openings at SailPoint. SailPoint is a leading provider of identity security for the modern enterprise. Enterprise security starts and ends with identities and their access, yet the ability to manage and secure identities today has moved well beyond human capacity. Using a foundation of artificial intelligence and machine learning, the SailPoint Identity Security Platform delivers the right level of access to the right identities and resources at the right time—matching the scale, velocity, and environmental needs of today’s cloud-oriented enterprise. Our intelligent, autonomous, and integrated solutions put identity security at the core of digital business operations, enabling even the most complex organizations across the globe to build a security foundation capable of defending against today’s most pressing threats. The employment policy of SailPoint is to provide equal opportunity to all persons, and it is SailPoint’s policy to take affirmative action to employ and advance in employment protected veterans and individuals with disabilities. It is SailPoint’s policy to recruit, hire, train and promote qualified individuals in all job titles, and ensure that all other personnel actions are administered without regard to race, color, religion, national origin, sex, military and/or veteran status, disability, or other legally protected status, and we will ensure that all employment decisions are based only on valid job
requirements. SailPoint does not discriminate on the basis of national origin or citizenship status as provided under the Immigration Reform and Control Act of 1986. Employees and applicants shall not be subjected to harassment, intimidation, threats, coercion, or discrimination because they have engaged in or may engage in any of the following activities: Filing a complaint; Assisting or participating in an investigation, compliance evaluation, hearing, or any other activity related to the administration of the affirmative action provisions of Section 503, VEVRAA, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; Opposing any act or practice made unlawful by Section 503, VEVRAA, or their implementing regulations in this part, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; or Exercising any other right protected by section 503, VEVRAA or their implementing regulations. SailPoint will also provide reasonable accommodation to known physical or mental limitations of an otherwise qualified employee or applicant for employment, unless the accommodation would impose undue hardship on the operation of our business. SailPoint’s affirmative action program contains an audit and reporting system which enables us to measure the effectiveness of our program, indicate any need for remedial action, determine the degree to which our objectives have been attained, determine whether protected veterans and individuals with disabilities had had the opportunity to participate in company-sponsored activities, measure our compliance with the program’s specific obligations, and document actions taken to comply with these obligations.
