Information Security Compliance & Audit Manager

Salary may be negotiable within the range listed above, based on position requirements and successful candidate's qualifications, subject to appropriate authorization.

This recruitment will establish an open eligible list that will be used to fill current and future Technology Services Manager positions. The eligible list established may also be used to fill positions in similar and/or lower classifications throughout the County of Orange.

This recruitment will open for a minimum of five (5) business days and will close on Tuesday, November 10, 2026, at 11:59 P.M. (PST).

The mission of Orange County Information Technology (OCIT) is to provide innovative, reliable, and secure technology solutions that support County departments in the delivery of quality public services. OCIT provides IT solutions across County departments for voice communications, network services, application support, service desk, desktop support, as well as data center services.

The Orange County Information Technology (OCIT) Countywide Services is seeking an experienced and dynamic manager who will provide audit support, vendor security risk assessment, and PCI (Payment Card Industry) compliance management. The Information Security Compliance & Audit Manager (Technology Services Manager) serves as the enterprise owner of OCIT's centralized audit coordination services and is the County's primary liaison for IT audits, security assessment, external auditors, vendors, and internal stakeholders.

This position requires strong analytical and comprehension skills with written and communication experience.

• Working in a multidisciplinary IT environment, including IT teams and coordinating efforts to meet audit requirements.
• Serving as the primary audit liaison and advocate between internal stakeholders and OCIT, fostering strong partnerships and ensuring effective communication across organizations.
• Leading audit planning and execution, communications and escalation paths.
• Providing guidance and recommendations to County departments with PCI audit scoping, executing recurring vulnerability site scans and evaluating new device purchases.
• Explaining and presenting executive-level audit status reporting, trend analysis, and lessons learned to drive continuous improvement.
• Coordinating cross-functional review involving OCIT Security, OCIT Functional Services Team (Server, Desktop, Cloud), OCIT Business Relationship Management Team, Privacy, Legal, Procurement departments.
• Ensuring all new technologies and service providers align with County Information security, privacy, and procurement requirements.
• Facilitating the Countywide Security Review & Approval (SRA) process for new technologies, cloud services, SaaS platforms, and third-party vendors.
• Conducting security and privacy evaluations of vendor solutions to meet County security compliance.
• Leading the development of training materials and facilitating training sessions and workshops.
• Maintaining a centralized vendor risk inventory within the GRC (Governance, Risk and Compliance) platform, Optro.
• Utilizing project organization management including scheduling, milestones, deliverables to achieve successful outcomes.
• Making policy and business decisions using sound judgement and risk management.
• Traveling throughout Orange County and attending staff meetings as needed, along with performing related duties as assigned.

In addition to the minimum qualifications, the ideal candidate will possess at least three (3) years of work experience performing audit support, IT audits, IT compliance, PCI DSS (Payment Card Industry Data Security Standard), or a combination of the above.

While not required, the ideal candidate will also possess one of the following certifications:

• CISA:
  Certified Information System Auditor
• CISSP:
  Certified Information Systems Security Professional
• CRISC:
  Certified in Risk and Information Systems Control
• PCI ISA:
  Internal Security Assessor or equivalent

In addition, the ideal candidate will also have extensive experience in the following core competencies:

• Analyzing, administering, and maintaining information security architecture, information security technologies, tools, appliances, practices and controls.
• Understanding Information Technology and applying advanced…