A payments API company in the mould of Stripe, with 40 engineers, is told by sales that three enterprise deals need SOC 2 Type II, ISO 27001 and PCI DSS within six months. The CEO asks you to lead it. How do you respond in the first meeting?

What the interviewer is testing

Whether you treat compliance as an architecture and scoping problem rather than a documentation project, and whether you will say what cannot be promised in six months.

Clarifying questions that change the answer

• Who handles card data? If the company never stores, processes or transmits card numbers (a tokenising provider does), PCI scope may be a short self-assessment rather than a full assessment.
• What is truly contractual? Is each deal tied to a certificate, or to a questionnaire? Some buyers accept a SOC 2 Type I plus a roadmap.
• What is the observation period? Type II covers a period of operation, commonly 3 to 12 months; a first report with a six-month window is possible but the timeline starts when controls are operating, not when they are designed.
• Where is the data? Regions, subprocessors and production access paths define the scope.

The arc of a strong answer

1. Map the three to a common control set. The frameworks overlap heavily (access control, change management, logging, incident response, vendor management); build once, map thrice. A single control set typically covers most of each.
2. Reduce scope before documenting it. Isolate cardholder data in the smallest possible environment or remove it entirely by using a hosted payment field; fewer systems in scope is the cheapest control.
3. Sequence the deadlines honestly. SOC 2 Type I within about three months is plausible; Type II needs an observation window that has to elapse; ISO 27001 requires an information security management system and a certification audit in two stages, usually 4 to 9 months for a company starting from nothing; PCI depends on level and scope.
4. Automate evidence. Pull access reviews, change records and configuration state from systems of record, so the audit is a query, not a quarter-end scramble.
5. Name an owner and a budget: audit fees, a compliance platform, and about one engineer-equivalent of effort.

Common weak answers

• "We will be certified in six months." A promise the observation period makes impossible for Type II.
• "Get a tool that handles it." Tools collect evidence; the controls still have to exist and operate.
• "Treat each framework as a separate project." It triples effort for overlapping controls.

What a strong answer adds

A risk-based deal triage: ask which deal accepts an interim letter. The cost of getting it wrong: a failed audit or a qualified opinion is worse than a delay. And ongoing operation: compliance that depends on a heroic annual sprint decays; building it into pull requests, access reviews and change approval makes it continuous.

When this level of programme is too much

A seed-stage company with no enterprise deals should do the security fundamentals the frameworks require (MFA, logging, backups, access review) and defer certification until a deal needs it. The controls are the work; the certificate is the receipt.