Information Security- GRC

Information Security Compliance Analyst

Job Description:

Fluke's Information Security GRC team is seeking an experienced compliance professional to lead day-to-day execution of our audit and certification programs which include: SOX ITGC / ITAC, ISO 27001, SOC 2 Type II, NIS2, EU Cyber Resilience Act, and Cyber Essentials Plus. Also to help extend our coverage into emerging regulatory and AI governance requirements. You will serve as a primary point of contact for our external auditors and Internal Audit, translate audit requirements into clear asks for IT and business control owners, and keep evidence accurate, complete and on time.

This is more than an audit compliance role. You will also own key parts of our risk program, third-party risk management (TPRM) and enterprise / information security risk management (ERM) and help customers trust Fluke products by completing security questionnaires and assessments about our products, software and services.

Reporting to the Senior Information Security Compliance Lead, you will step into ownership of established work streams through a structured onboarding and knowledge-transfer period, and are expected to operate independently on core audit programs within the first six months. This role is critical to protecting Fluke's audit posture, reducing compliance risk, and keeping our commitments to auditors, Fortive and customers.

Responsibilities:

Audit leadership & SOXLead SOX ITGC and ITAC execution: quarterly and occurrence-based control performance, roll-forward inquiries, control testing and evidence submission, in partnership with the external auditor and Fortive Internal Audit.

Act as primary audit liaison: lead walkthroughs, manage PBC / evidence requests, translate auditor follow-ups into defined requirements for control owners, and deliver complete evidence before deadlines.

Coordinate evidence across key systems, including ERP, data and analytics platforms, and change-management tooling. Covering privileged access, change management, key reports / IPE and ITAC configurations.

Maintain segregation of duties within the team's test / review / sign-off model, performing control testing and secondary review as required.

Track and report control status, remediation items and prior-year improvement opportunities to GRC leadership and Finance stakeholders; act as SOX lead during the Compliance Lead's absence.

Certifications & attestations

Own ISO 27001 control operations: control ownership, quarterly access reviews, control evaluations, corrective actions, and surveillance / recertification audits, including onboarding new products into scope.

Lead or support SOC 2 Type II and Cyber Essentials / CE+ audits from scoping and kickoff through auditor facilitation and evidence collection.

Customer & product security assurance

Own completion of customer security questionnaires and RFP / RFI security sections for Fluke products, software and services (including connected test tools, coordinating with Product Security, Engineering, IT, Legal and Sales for accurate, on-time responses.

Maintain an approved answer library and supporting evidence (policies, certifications, SOC 2 reports, penetration test summaries) and keep Trust Center content current.

Support customer and supplier security audits and assessments, and track security commitments made to customers through to closure.

Escalate product-specific gaps or contractual security requirements to Product Security and Legal, and feed recurring customer asks back into the control program.

Regulatory frameworks & emerging requirements

Maintain framework mappings (SOX, ISO 27001, SOC 2, NIST 800-171 / CMMC, NIS2, PCI DSS, EU Data Act) to a unified control set so controls are tested once and satisfy many requirements.

Support EU Cyber Resilience Act (CRA) compliance with Product Security / PSIRT, and monitor and gap-assess new cybersecurity regulations with Fluke Compliance teams to reduce duplicate work.

Third-party risk management (TPRM)
Own the TPRM process from intake to closure, managing a steady volume of vendor requests: scoping, risk tiering, and determining when suppliers fall outside TPRM scope.

Conduct vendor security assessments, review security questionnaires, SOC reports, certifications and contract security terms, and document risk-based approvals, conditions (e.g., use of Fluke-provided environments) and remediation.

Partner with Procurement, Legal and business owners so reviews keep pace with onboarding; establish ongoing monitoring for…