- Company
- Online therapy provider, USA, remote (name removed)
- Source
- Job posting, 21 October 2026. First dedicated security hire.
- Evidence
- “Own our path to SOC 2 Type I and Type II: scoping, control design, evidence collection, auditor selection.”
- Stage
- Starting. No auditor chosen.
- Fit check
- Handles health data, so HIPAA applies too.
- Opening line
- “You are hiring the person who will run your first SOC 2. Until they start, we can scope the pentest so it is ready for the Type I date.”
The words “SOC 2” are not the lead.
A keyword search gives you thousands of rows. Almost all of them are a skill on a wish list, or a company that passed its audit years ago. We counted.
274,122open job postings read, at about 9,000 companies
3,108name SOC 2 or ISO 27001
33clearly say the company works toward its first audit
Measured on 14 November 2026 from public job boards. The bars are to scale. The last one would be thinner than one pixel, so it is drawn 2 pixels wide.
Two public sources. Both read in full.
Some companies announce a first audit in a job posting. Others state it only on their own website. We read both.
Job postings
A company that hires its first security or compliance person often writes the plan into the posting. It tells you who will choose the vendors, and how far the work is.
Staff Cloud Security EngineerFirst security hire
“…auditor selection and management”No auditor yet
Company websites
Some companies state on their own site that an audit is under way. Then the audit window is open now. That is when the company buys its pentest.
First auditUnder way
PentestNot bought yet
What we remove before you see the list
- Skills on a wish listThe sentence says nothing about the company.“Experience in HIPAA, SOC 2, or similarly regulated environments is a plus.”
- Companies that already hold the reportThey maintain an audit. They do not start one.“…maintaining compliance with existing standards (ISO 27001 and SOC2 Type 2)”
- Security and compliance vendorsTheir postings name SOC 2 all the time.
- Pages with a passed dateThe audit window closed, or the page is no longer updated.
- Companies that already name a pentestA finished test, or a chosen tester, is on the page.
- Projects with no sign of a businessNo staff, funding or customers that we can find.
What one lead looks like.
Two real leads from November 2026. We removed the company names here. Your list shows the name and the link.
- Company
- Customer-content software for online shops, 23 staff (name removed)
- Source
- Company website, read on 14 November 2026.
- Evidence
- “No third-party penetration test yet; one is planned as part of SOC 2 readiness.”
- Stage
- In audit. No report yet. Pentest not bought.
- Fit check
- Small team. Fits an entry-level SOC 2 test.
- Opening line
- “Your website says a pentest is planned for SOC 2. We do right-sized SOC 2 tests for teams your size, and can send the scoping sheet today.”
Every lead shows its evidence and its source, so you can judge it in ten seconds.
From public page to your inbox.
We search
Each week we read new job postings and company websites.
We read and judge
AI reads each page in full and labels it: first audit, existing audit, skill only, or vendor. We check the leads before they go out.
You get a short list
We check each lead against your region and client size. The list arrives by email. There is nothing to set up.
Three companies that fit your startup pentest work:
1
Customer-content software, 23 staff. Their website:
“No third-party penetration test yet; one is planned as part of SOC 2 readiness.”
Link to the page
2
Online therapy, USA. Hiring their first security person to
“own our path to SOC 2 Type I and Type II”
Link to the job posting
3
Social media software, Boston. Hiring a security engineer:
“By 6 months, core SOC 2 controls are documented”
Link to the job posting
Built for the firms that do the work.
Pentest firms
Reach the buyer before the audit window closes. Then keep the client for the yearly retest.
Audit and CPA firms
Find companies that have not named an auditor yet.
vCISO and readiness consultancies
Find companies that work toward SOC 2 and have no security lead.
Questions
- Where does the data come from?
- From job postings that companies publish on public job boards, and from their own public websites. We use no logins and no private data.
- How accurate are the leads?
- Every lead shows the exact sentence and a link to the source. You can check it yourself before you write to anyone.
- How many leads will I get?
- We do not promise a number. First audits are rare, and the count changes with your region and client size. The free sample shows you what a real list looks like for your firm.
- Will other firms get the same leads?
- They can. We check each lead against what a firm sells, so two firms rarely get the same list.
- Do you give me contact details?
- No. You get the company, the evidence and the source. You find the right person with the tools you already use.
- Which audits do you cover?
- SOC 2 and ISO 27001.
- Which countries?
- Companies worldwide that publish in English. Tell us your region and we match the list to it.
- What does it cost?
- The sample list is free. If it is useful to you, we talk about a weekly list.
See who's starting an audit in your market.
Tell us your region and the size of company you serve. We make a sample list for your firm and send it by email. It is free.
We use your details only to make and send the sample list.