Compliance Analyst (SOC -2 Type -2)

Sita; New Delhi; On-site; INR 1,400,000 - 2,100,000; Full time

Job summary

SITA is seeking an experienced Compliance professional to support the SOC 2 Type 2 program across its operations and infrastructure. You will help implement, monitor, and improve controls aligned with the Trust Services Criteria and internal policies.

The role involves coordinating with internal teams and external auditors, maintaining evidence, and ensuring audit readiness through documentation and control matrices. A hands-on, collaborative mindset is essential.

Qualifications

• Minimum 5 years in QA, InfoSec, or Compliance with SOC 2/ISO 27001/PCI DSS.
• Experience implementing SOC 2 Type 2 programmes and audit readiness.
• SSDLC, access control, incident response, and risk assessments experience.
• Cross-functional teams to implement security controls and respond to findings.

Responsibilities

• Develop and execute a SOC 2 Type 2 compliance programme with documentation, evidence, and control matrices.
• Coordinate with internal teams and external auditors to deliver artefacts on time.
• Support implementation and validation of access management, monitoring, incident response, and data protection controls.
• Maintain Roles and Responsibilities Matrix for SOC 2 scope accountability.
• Monitor the effectiveness of SOC 2 controls and identify remediation gaps.
• Lead internal readiness assessments and mock audits for formal SOC 2 evaluations.
• Track and manage audit findings and document corrective actions.
• Deliver SOC 2 awareness and training sessions for relevant teams.
• Assist in planning and estimating compliance-related activities and timelines.
• Ensure documentation (policies, procedures, diagrams, logs) is updated for audits.

Skills

SOC 2 knowledge

Security leadership

Audit readiness

Documentation proficiency

Communication skills

SSDLC

Education

Bachelor's degree in CS/IS/Engineering

CISA

CISM

ISO 27001 Lead Implementer

ISEB Foundation

SOC 2 Practitioner

Tools

Log management tools

Access reviews tools

Vulnerability assessment tools

Change tracking tools

Job description

Job Summary

Purpose: Support the implementation, control, and continuous improvement of SOC 2 Type 2 compliance across SITA's operational and infrastructure environments. This includes preparing for and supporting external audits, maintaining documentation, and ensuring alignment with the SOC 2 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy) as well as SITA's internal security and operational policies.

Responsibilities

• Assist in the development and execution of a SOC 2 Type 2 compliance programme, including the creation and maintenance of required documentation, audit evidence, and control matrices aligned with the Trust Services Criteria.
• Coordinate with internal stakeholders (e.g. GRC, SoC, Infrastructure, Development, and Integration teams) and external auditors to ensure timely and accurate delivery of compliance artefacts.
• Support the implementation and validation of technical and administrative controls such as access management, system monitoring, incident response, and data protection in line with SOC 2 requirements.
• Maintain and update the Roles and Responsibilities Matrix to ensure all personnel involved in SOC 2 scope understand and acknowledge their duties.
• Monitor and report on the effectiveness of SOC 2 controls, identifying gaps and recommending remediation actions.
• Facilitate internal readiness assessments and mock audits to ensure preparedness for formal SOC 2 Type 2 evaluations.
• Track and manage audit findings, ensuring timely resolution and documentation of corrective actions.
• Support the development and delivery of SOC 2 awareness and training sessions for relevant teams.
• Assist in the planning and estimation of compliance-related activities, including resource needs and timelines.
• Ensure that all documentation (e.g. policies, procedures, system architecture diagrams, change control logs) is reviewed and updated regularly to meet SOC 2 audit requirements.

Experience

• Minimum of 5 years experience in a Quality Assurance, Information Security, or Compliance environment, with hands-on involvement in regulatory frameworks and standards such as SOC 2, ISO 27001, or PCI DSS.
• Demonstrated experience in implementing and supporting SOC 2 Type 2 compliance programmes, including evidence collection, control validation, and audit readiness.
• Familiarity with secure system development lifecycle (SSDLC), access control management, incident response, and risk-based control assessments aligned with the Trust Services Criteria.
• Experience working with cross-functional teams (e.g. infrastructure, development, operations, and GRC) to implement security controls, respond to audit findings, and drive continuous improvement.

Knowledge & Skills

• Strong understanding of SOC 2 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy), including scoping, control mapping, and evidence documentation.
• Knowledge of security best practices for access control, system monitoring, data encryption, secure configuration, and incident response.
• Ability to interpret audit requirements and translate them into actionable tasks for technical and non-technical stakeholders.
• Proficiency in preparing and maintaining compliance artefacts such as control matrices, risk assessments, roles and responsibilities documentation, and policy/procedure manuals.
• Familiarity with tools and platforms used for log management, access reviews, vulnerability assessments, and change tracking.
• Excellent communication and documentation skills, with the ability to explain complex compliance topics clearly and effectively across diverse teams.

Profession Competencies

• SOC 2 Type 2 Implementation
• Compliance Management
• Business Process Improvement
• Managing Risk
• Audit Readiness & Response
• Secure System Development Lifecycle
• Standards, Procedures & Policies
• Supplier Security Assurance
• Quality Management

Core Competencies

• Adhering to Principles & Values
• Communication
• Creating & Innovating
• Customer Focus
• Developing Talent
• Impact & Influence
• Leading Execution
• Managing Performance
• Results Orientation
• Teamwork

Education & Qualifications

• University degree or equivalent, preferably in Computer Science, Information Security, Engineering, or a related field.
• Industry certifications such as Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), SOC 2 Certified Practitioner, or ISO 27001 Lead Implementer are highly desirable.
• ISEB Foundation or equivalent quality assurance qualification is a plus.
• Familiarity with audit frameworks and regulatory standards including SOC 2, ISO 27001, and PCI DSS.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.