# How Do I Find Companies Working Toward SOC 2 or Another Certification? > A GTM play for Revnu. A company hiring for SOC 2, ISO 27001, HIPAA or GDPR work has a deadline, usually set by a big customer, and a budget to hit it. Revnu finds those job posts and pages and writes about getting certified on time. Canonical: https://revnu.com/docs/play-compliance-hires Last updated: 2026-11-08 A company hiring a security or compliance person, or posting a job that mentions SOC 2, ISO 27001 or HIPAA, has a deadline. Usually a big customer asked for the certificate. Revnu finds those posts and the pages that show a company is working toward one, and writes about getting there on time. ## Why it works Compliance work starts because a deal depends on it, so it comes with urgency and a budget. The job post tells you which standard, how far along they are and who owns it. That's everything a compliance, security, legal or audit seller needs to write a useful first email. ## How to run it 1. **Name the standard.** SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, or the one you help with. 2. **Find the signals.** Revnu finds job posts that mention it and company pages that mention working toward it. 3. **Read the stage.** "Achieve SOC 2 Type I" means starting. "Maintain our ISO 27001" means renewing. Revnu notes which. 4. **Find the owner.** The CTO, head of security or founder, with a checked work email. 5. **Write about the deadline.** Offer to get them certified faster, or to answer the security questionnaires in the meantime. ## The prompt > Find software companies with [20 to 200] staff whose job posts from the last 60 days mention [SOC 2 / ISO 27001 / HIPAA]. Note whether they're starting or maintaining it. Find the [CTO / head of security] and their work email. Write an email that mentions the certification they're working toward and offers to help them get there [faster / with less work]. [Try this in Revnu](https://revnu.com/sign-up?prompt=Find%20software%20companies%20with%20%5B20%20to%20200%5D%20staff%20whose%20job%20posts%20from%20the%20last%2060%20days%20mention%20%5BSOC%202%20%2F%20ISO%2027001%20%2F%20HIPAA%5D.%20Note%20whether%20they%27re%20starting%20or%20maintaining%20it.%20Find%20the%20%5BCTO%20%2F%20head%20of%20security%5D%20and%20their%20work%20email.%20Write%20an%20email%20that%20mentions%20the%20certification%20they%27re%20working%20toward%20and%20offers%20to%20help%20them%20get%20there%20%5Bfaster%20%2F%20with%20less%20work%5D.) Each lead keeps the job post on its **Signals** tab. Your first sequence waits for your approval in **Review**. ## Run it every week > Every Monday, find companies whose job posts from last week mention [standard] and add the ones that fit our buyer to the Compliance campaign. Set it up as a [workflow](https://revnu.com/docs/recurring-work.md) once and it runs on its own. See [recurring work with workflows](https://revnu.com/docs/recurring-work.md) and the [workflows API](https://revnu.com/docs/workflows.md). ## Related [Intent signals library](https://revnu.com/docs/intent-signals.md), [hiring signals play](https://revnu.com/docs/play-hiring-signal.md), [tech stack switch play](https://revnu.com/docs/play-tech-stack-switch.md) and [all GTM plays](https://revnu.com/docs/play-overview.md). ## Frequently asked questions ### Which job posts count? Any role whose post mentions the standard: security engineers, compliance managers, IT leads, even engineering roles that list "help us achieve SOC 2". Revnu searches the words in the post, not just the title. ### Can Revnu tell if they're already certified? Revnu checks the company's website and trust page for a badge or report and notes what it finds. A company that's already certified may still need renewal help, so keep or drop them as you prefer. ### Who sells well with this play? Compliance and security software, auditors, penetration testers, fractional security leads, legal and privacy firms, and anyone whose product helps pass a security review. ### Is the job post enough reason to write? Yes. It's public, it's dated and it states the goal. Mention the standard in one line and lead with how you help. ### Can I combine this with funding? Yes. "Raised a Series A in the last six months and hiring for SOC 2" finds companies whose first enterprise deals just started asking.