Security Compliance Specialist II

As a Compliance Specialist II within Security Compliance, you will be a key contributor to Akamais security compliance posture by leading hands-on control testing, risk identification, and audit management.

Specific responsibilities include:

• Controls Testing & Assessment:
  Execute design and operating effectiveness testing for technical, physical, and operational security controls across primary frameworks such as SOC 2, ISO 27001, and PCI DSS.
• Evidence Collection & Walkthroughs:
  Coordinate sampling populations, lead technical walkthroughs with Engineering, Dev Ops, and IT system owners, and review technical evidence.
• Deficiency Analysis & Remediation:
  Identify control gaps, document exception trends in our GRC platform, and partner with system owners to draft actionable remediation plans and track them to closure.
• Third-Party Audit Support:
  Serve as a controls liaison during external audits, managing evidence pipelines, helping explain technical control implementations to auditors, and minimizing business disruption.
• Process Optimization:
  Partner with engineering teams to transition manual control testing toward continuous control monitoring using GRC tooling and automation.

Applicants must meet one of the following education and experience requirements:

• 4 years of relevant experience and a Bachelors degree or
• Equivalent and, or relevant professional experience

Qualifications

• 4+ years of hands-on experience evaluating or testing security controls against industry standards, with a strong emphasis on SOC 2, ISO 27001, or PCI DSS.
• Working knowledge of core technical security controls (e.g., Identity & Access Management, Change Management, Vulnerability Management, and Logging/Monitoring).
• Strong analytical, problem-solving, and written/verbal communication skills.
• Relevant security or audit certifications (e.g., CISA, CRISC, Security+, CISM, or ISO Lead Auditor) preferred but not required.
• Experience working with cloud infrastructure, containerized environments, or distributed systems preferred but not required.