IT compliance

VDart Inc; United States; Remote; USD 83,000 - 124,000; Full time

Job summary

VDart Inc is seeking an IT Compliance contractor for a 6-month remote engagement. The role requires strong SOX/ITGCs knowledge and the ability to work directly with engineers to design and implement controls and remediation solutions.

The candidate will tackle production change controls, access controls, evidence generation, and remediation activities while ensuring audit readiness. Experience with SOC 2 is valuable, and ISO is a future consideration.

Qualifications

• Experience with SOX/ITGCs and compliance requirements.
• Ability to work with engineers to design and implement controls and remediation solutions.
• Willingness to own remediation work and collaborate across engineering and control owners.

Responsibilities

• Lead production change controls, including pre-deployment testing and approvals.
• Manage access controls and reviews, eliminating self-approvals.
• Script and validate evidence generation for changes and access controls for auditor reporting.
• Oversee backup and recovery controls, inventories, and monitoring of critical data stores.
• Document controls, SOPs, and runbooks to support audit readiness.
• Coordinate with engineering to remediate gaps as they arise.
• Support expanding SOC 2 compliance scope and prepare for ISO considerations.

Skills

SOX/ITGCs knowledge

Compliance requirements

Scripting ability

Tools

AWS

GitHub

Datadog

CircleCI

PlanetScale

Orchard

SIMPLE

Job description

Job role: IT Compliance
Duration: 6 month
Location: Remote

They need someone who understands SOX/ITGCs and compliance requirements, but is technical enough to work directly with engineers to design and implement controls and remediation solutions.

The environment includes a combination of custom internal applications and third-party platforms, including:

• AWS
• GitHub
• Datadog
• CircleCI
• PlanetScale
• Custom internal tools, including Orchard and SIMPLE

The ability to script and build remediation fixes directly is important. They're not looking for someone who will simply identify findings, coordinate action items, or manage project status.

Some of the immediate areas they need help with include:

• Production change controls, including pre-deployment testing and approval requirements
• Access controls and access reviews, including eliminating self-approvals
• Scripting and validating evidence generation for change and access controls to ensure complete populations/reporting for auditors
• Backup and recovery controls, including inventories and failure monitoring for financially relevant data stores
• Control documentation, SOPs and runbooks
• Evidence collection and audit readiness
• Working directly with engineering/control owners to remediate gaps as they arise
• Supporting the broader SOX compliance program as the audit scope continues to expand

Their SOX controls are already in place and continuing to mature, but gaps continue to surface as the scope expands. A number of the remediation activities have been falling on senior engineers, so the idea is to bring in someone who can take ownership of that compliance/remediation work while still operating effectively within the engineering environment.

SOC 2 is earlier stage, with an auditor engaged but internal execution not yet underway, so experience helping build out SOC 2 compliance would also be valuable. ISO is only a future consideration at this point.