Job Description & How to Apply Below
Hands-on experience in SOC 2 Type I and Type II implementation/readiness and delivery.
Strong understanding of AICPA Trust Services Criteria (TSC) .
Experience with control mapping, gap assessments, evidence collection and validation.
Understanding of Type II observation periods , control operating effectiveness and exceptions.
Experience coordinating with external auditors/CPA firms.
Ability to manage SOC 2 engagements from kickoff through audit closure .
2. ISO 27001 Expertise
Strong understanding of ISO/IEC 27001:2022 requirements.
Experience implementing and maintaining an Information Security Management System (ISMS) .
Conducting ISO 27001 gap assessments and readiness assessments.
Understanding of Annex A controls and applicability assessment.
Experience with :
Risk assessment and risk treatment
Statement of Applicability (SoA)
Information security policies and procedures
Internal audits
Management reviews
Corrective actions / NC management
Continual improvement
ISMS metrics and monitoring
Experience supporting organizations through ISO 27001 certification audits .
Understanding of Stage 1 and Stage 2 audit processes.
3. Governance, Risk & Compliance (GRC)
Strong understanding of GRC frameworks and principles .
Ability to establish and maintain governance processes.
Experience with :
Risk management
Control frameworks
Compliance assessments
Regulatory requirements
Policy governance
Exception management
Risk acceptance
Corrective and preventive actions
Compliance monitoring
Ability to map controls across multiple frameworks such as SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA , etc.
4. Compliance & Audit Management
Manage internal and external compliance assessments.
Prepare organizations for certification and attestation audits .
Develop audit plans, evidence trackers and compliance calendars.
Review audit evidence for completeness and adequacy.
Manage audit observations, non-conformities and corrective actions .
Coordinate with auditors and stakeholders to resolve audit queries.
Maintain appropriate audit trails and compliance documentation.
5. Risk Management
Conduct information security risk assessments.
Identify, assess and prioritize organizational risks.
Develop Risk Treatment Plans (RTPs) .
Maintain risk registers.
Evaluate residual risk and risk acceptance.
Support business owners in implementing appropriate risk mitigation measures.
6. Policies & Documentation
Candidate should be comfortable creating/reviewing:
Information Security Policy
ISMS documentation
Risk Management Policy
Access Control Policy
Incident Management Policy
Business Continuity/DR policies
Vendor Risk Management Policy
Change Management Policy
Secure SDLC policies
Data Protection/Privacy policies
Business Continuity documentation
Control procedures and work instructions
7. Client & Stakeholder Management
Conduct client discovery and kickoff meetings.
Understand business processes, technology environments and compliance requirements.
Act as the primary delivery contact for clients.
Conduct regular status meetings.
Track milestones, dependencies, risks and deliverables.
Communicate compliance requirements clearly to technical and non-technical stakeholders .
Manage escalations and ensure timely closure of deliverables.
8. Technical Security Understanding
Candidate should have a good working understanding of:
AWS / Azure / GCP
IAM, SSO and MFA
Vulnerability management
Secure SDLC
Change management
Incident response
Logging and monitoring
Encryption
Backup and DR
Endpoint security
Network security
Asset management
Vendor/third-party security
Data protection
They don't need to be a penetration tester or security engineer, but should be able to understand technical controls and assess their compliance implications .
Key Skills
Must Have:
SOC 2 Type I/II
ISO 27001:2022
ISMS implementation
GRC
Risk assessment & treatment
Control assessment
Audit management
Evidence review
Compliance management
Policy/procedure development
Client management
Strong documentation and communication skills
Good to Have:
CISA / CISSP / CRISC
ISO 27001 Lead Auditor / Lead Implementer
ISO 27701
PCI DSS
HIPAA
GDPR
NIST CSF / NIST 800-53
CSA CCM
Experience with GRC platforms such as Vanta, Drata, Secureframe, One Trust , etc.
Note that applications are not being accepted from your jurisdiction for this job currently via this jobsite. Candidate preferences are the decision of the Employer or Recruiting Agent, and are controlled by them alone.
To Search, View & Apply for jobs on this site that accept applications from your location or country, tap here to make a Search:
To Search, View & Apply for jobs on this site that accept applications from your location or country, tap here to make a Search:
Search for further Jobs Here:
×