Security Compliance Auditor

Arancia; Philippines; Remote; PHP 1,200,000 - 2,100,000; Full time

Job summary

Arancia Technologies is seeking a Security Compliance Auditor to lead internal audits, assess regulatory gaps, and prep clients for external audits across SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, and NIST frameworks. You will map controls, guide risk remediation, and produce prioritized, actionable roadmaps for clients.

The role emphasizes risk management, policy development, evidence collection, and clear communication with technical staff and executives.

Qualifications

• Bachelor's degree in cybersecurity, IT, information systems, accounting or related field.
• 3–5 years of experience in IT audit, internal audit, security compliance, or cybersecurity consulting.
• Hands-on audits against at least two of SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, or NIST.
• Working knowledge of regulatory and external audit processes and evidence/documentation expectations.
• Strong understanding of risk management frameworks and methodologies such as NIST RMF, ISO 27005, or ISO 31000.

Responsibilities

• Lead internal audits, gap assessments, and readiness assessments against industry standards and regulatory frameworks.
• Apply risk management frameworks to identify, rate, and prioritize compliance and security risks.
• Develop remediation roadmaps linking gaps to risk, owners, effort and target dates.
• Prepare clients for external audits with scoping, evidence packages, and mock assessments.
• Deliver clear audit documentation, gap reports, findings, risk ratings, and recommendations.

Skills

Audit & compliance

Risk management

Regulatory frameworks

Education

Bachelor's degree in Cybersecurity / IT / IS / Accounting

Job description

Job Title: Security Compliance Auditor

Location: Remote – Philippines
Employment Type: Full‑Time
Working Hours: 8:00 AM – 5:00 PM Eastern Time (ET), Monday to Friday
Company: Arancia Technologies Inc.

About Arancia Technologies

Arancia Technologies is a Canadian cybersecurity consulting, advisory, and technology firm providing comprehensive cybersecurity solutions and services to organizations across various industries.

We work with clients globally to strengthen their security posture, protect critical information assets, and address evolving cybersecurity challenges. Through our expertise and technology-driven approach, we help organizations build resilient and secure business environments.

About the Role

Arancia is seeking a Security Compliance Auditor to lead internal audits, framework and compliance gap assessments, and audit readiness assessments for clients across regulated and high-growth industries.

You will assess clients against industry standards and regulatory frameworks, identify where they fall short, and guide them to compliance and audit‑ready status. This role focuses on the work that happens before and around an external audit: understanding a client's current compliance posture, defining the target state, helping remediate gaps, and preparing teams and evidence so they can pass their certification or attestation with confidence.

The ideal candidate combines hands‑on audit and assessment experience with a strong grounding in risk management and the ability to turn findings into clear, prioritized roadmaps that technical and business stakeholders can act on.

Key Responsibilities

Audit, Assessment and Readiness

• Lead internal audits, gap assessments, and readiness assessments against industry standards and regulatory frameworks, including SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, and NIST frameworks.
• Assess clients' current compliance posture by reviewing policies, procedures, control design, implementation, and supporting evidence.
• Lead client interviews, process walkthroughs, control testing, and evidence-review sessions.
• Map controls across multiple frameworks to reduce duplicate effort and give clients a unified view of compliance.

Risk Management

• Apply risk management frameworks such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and NIST CSF 2.0 to identify, rate, and prioritize compliance and security risks.
• Help clients build or mature risk registers, risk treatment plans, and risk acceptance processes.
• Communicate risk clearly to both technical teams and executive leadership.

Remediation and Strategic Guidance

• Help clients define strategic goals for becoming compliant, including target scope, timelines, and certification or attestation milestones.
• Develop prioritized remediation roadmaps that link each gap to its risk, owner, effort, and target date.
• Guide clients through remediation, including policy and procedure development, control implementation, and evidence collection.
• Validate remediation and confirm controls are operating as intended before an external audit.

External Audit Preparation and Support

• Prepare clients for external audits and certifications, including scoping, evidence packages, and mock or pre‑assessment walkthroughs.
• Support clients during external audits by coordinating evidence requests and responding to auditor questions alongside the client.
• Help clients interpret and respond to external audit findings and regulatory requirements.

Engagement Delivery

• Prepare clear audit documentation, gap reports, findings, risk ratings, and recommendations for clients and stakeholders.
• Manage multiple concurrent engagements, delivering high‑quality work on time and within scope.
• Advise clients on strengthening internal controls, governance, risk management, and compliance programs.

Qualifications and Experience

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Accounting, or a related field.
• 3–5 years of experience in IT audit, internal audit, security compliance, or cybersecurity consulting.
• Hands‑on experience conducting internal audits, gap assessments, or readiness assessments against at least two of: SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, or NIST frameworks.
• Working knowledge of regulatory and external audit processes, and of what auditors and assessors expect in evidence and documentation.
• Strong understanding of risk management frameworks and methodologies, such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, or ISO 31000.
• Experience translating findings into remediation plans and compliance roadmaps for clients.
• Excellent written and verbal communication skills, with the ability to engage confidently with clients from technical staff to executives.
• Strong analytical and organizational skills, with the ability to manage competing priorities independently.

Working Hours

8:00 AM – 5:00 PM Eastern Time (ET), Monday to Friday.

Compensation

Market‑competitive compensation based on experience, qualifications, and expertise.