GRC Compliance Auditor

NorthMark Compute & Cloud; Dallas (TX); On-site; USD 90,000 - 140,000; Full time

Job summary

NorthMark Compute & Cloud in Dallas, TX is seeking a detail‑oriented GRC Compliance Auditor to join the Information Security team. You will own day‑to‑day SOC 2 Type II and ISO 27001 compliance activities, from readiness assessments and control mapping to evidence collection and external audit coordination.

You will administer the GRC platform, maintain the control library, automate evidence collection, and produce leadership reports.

Qualifications

• Bachelor’s degree in Information Systems, CS, Business or equivalent.
• 4–8 years of hands-on GRC, IT audit, or security compliance.
• Experience leading SOC 2 Type II audits and evidence collection.
• Knowledge of ISO 27001/27002 and related audits.
• Experience with GRC automation tools (Vanta/Drata/Hyperproof/AuditBoard).
• Ability to translate regulatory requirements into controls.
• Familiarity with IAM tools (Entra ID/Okta).
• Strong written and verbal communication.
• Certifications preferred: CISA, ISO 27001 Lead Auditor/Lead Implementer, CISM, CISSP, CRISC.

Responsibilities

• Lead SOC 2 Type II and ISO 27001 audits end-to-end.
• Coordinate external audits and manage evidence packages.
• Maintain cross-framework control library mapping SOC 2 TSC, ISO 27001 Annex A, NIST CSF, and other standards.
• Automate evidence collection and dashboards.
• Engage control owners across Engineering, IT, HR, Legal, and Operations.
• Respond to customer security questionnaires.

Skills

SOC 2 knowledge

Audit coordination

Regulatory mapping

Documentation & reporting

Education

Bachelor's degree in Information Systems/Computer Science/Business or equivalent

Tools

Vanta

Drata

Hyperproof

AuditBoard

Job description

The Company NorthMark Compute & Cloud (NMC²) is backed by dedicated leadership and investment, with a clear mission as it operates at the bleeding edge of technology. Its goal is to scale and enhance the high-performance computing (HPC) and cloud infrastructure that supports its clients’ research, production, and delivery, enabling breakthroughs that shape the industries of tomorrow. Its engineers build critical infrastructure to eliminate friction in scientific research, simulations, analysis, and decision‑making, accelerating discovery and driving faster innovation.

The Company NorthMark Compute & Cloud (NMC²) is backed by dedicated leadership and investment, with a clear mission as it operates at the bleeding edge of technology. Its goal is to scale and enhance the high-performance computing (HPC) and cloud infrastructure that supports its clients’ research, production, and delivery, enabling breakthroughs that shape the industries of tomorrow. Its engineers build critical infrastructure to eliminate friction in scientific research, simulations, analysis, and decision‑making, accelerating discovery and driving faster innovation.

THE POSITION

NMC² is looking for a detail‑oriented GRC Compliance Auditor to join the Information Security team, reporting to the GRC & Privacy Manager and based at our Dallas, TX offices at Victory Commons. This role owns the day‑to‑day execution of NMC²’s SOC 2 Type II and ISO 27001 compliance programmes — from readiness assessments and control mapping through to evidence collection and external audit coordination.

You will serve as the primary administrator of our GRC platform, maintaining the control framework library, driving automated evidence collection, and producing compliance posture reporting for leadership. You will work closely with control owners across Engineering, IT, HR, Legal, and Operations — translating regulatory requirements into practical controls and embedding audit readiness into how teams operate day to day.

The right candidate brings deep hands‑on experience with SOC 2 and ISO 27001, a sharp eye for control gaps, and the communication skills to guide both technical and non-technical stakeholders through audit processes without disrupting the business.

Responsibilities

• Lead internal audit cycles for SOC 2 Type II and ISO 27001, assessing the design and operating effectiveness of controls and identifying deficiencies for remediation.
• Coordinate external audits end-to‑end — scheduling walkthroughs, preparing evidence packages, managing auditor requests, and tracking findings through to validated closure.
• Conduct readiness assessments and gap analyses across compliance frameworks, recommending remediation actions prioritized by risk and business impact.
• Develop and maintain a cross‑framework control library mapping SOC 2 TSC, ISO 27001 Annex A, NIST CSF, and other applicable standards to NMC²’s operational controls.
• Serve as the primary administrator of the GRC and compliance automation platform — configuring control frameworks, evidence integrations, risk registers, and compliance dashboards.
• Drive adoption of automated evidence collection via integrations with IdP, IGA, HR, and infrastructure systems to reduce manual audit overhead across the business.
• Produce executive‑ready compliance posture reports, control health metrics, and audit‑readiness scorecards for leadership and board‑level stakeholders.
• Manage and track remediation of audit findings, exceptions, and risk acceptances, and conduct vendor and third‑party risk assessments against SOC 2 and ISO 27001 requirements.
• Develop audit readiness training, control owner guides, and playbooks to embed compliance awareness into day‑to‑day operations across Engineering, Product, and Operations teams.
• Respond to customer security questionnaires and due diligence requests relating to audit certifications and NMC²’s compliance posture.

Requirements

• Bachelor’s degree in Information Systems, Computer Science, Business Administration, or a related field — or equivalent experience.
• 4–8 years of hands‑on experience in GRC, IT audit, or information security compliance.
• Demonstrated experience conducting or supporting SOC 2 Type II audits, including evidence collection, control testing, and auditor coordination.
• Working knowledge of ISO 27001 / 27002 requirements, with experience supporting certification or surveillance audits.
• Hands‑on experience administering a GRC or compliance automation platform such as Vanta, Drata, Hyperproof, AuditBoard, or equivalent.
• Ability to translate complex regulatory requirements into practical, implementable controls and evidence procedures.
• Familiarity with identity and access management tooling (Entra ID, Okta, or equivalent) in the context of access reviews and compliance evidence.
• Experience working with control owners across Engineering, IT, Legal, HR, and Operations to define and validate control procedures.
• Strong written and verbal communication skills; comfortable presenting compliance findings to both technical and non‑technical audiences.
• One or more relevant certifications preferred: CISA, ISO 27001 Lead Auditor or Lead Implementer, CISM, CISSP, or CRISC.