IT Security, Risk, and Compliance Auditor - 10231

coupa-software-inc-ats-1; Reno (TX); On-site; USD 95,000 - 150,000; Full time

Benefits offered by this job

Global Wellness Days

Birthday Time-Off

Volunteer Time Off

Employee Assistance Program (EAP)

Business Travel Protection

Referral Bonus

Job summary

Coupa is seeking an IT Security, Risk, and Compliance Auditor to evaluate, strengthen, and automate the organization’s security controls and compliance posture across on‑prem and cloud environments.

You will conduct technical audits, implement automated control testing, and work with IT, security, and business units to improve control design and ensure alignment with standards such as ISO 27001, SOC 2, PCI DSS, NIST CSF, HIPAA, and FedRAMP.

Qualifications

• 3+ years in IT security auditing, technical risk assessments, or compliance.
• Strong knowledge of security frameworks (ISO 27001, SOC 2, PCI DSS, NIST CSF, HIPAA, FedRAMP).
• Experience with GRC platforms, compliance automation, control testing tools, and evidence collectionSystems.

Responsibilities

• Conduct technical audits & risk assessments of infrastructure, applications and cloud environments.
• Leverage automation & tools for automated control testing and evidence collection.
• Evaluate and improve security controls: access management, encryption and vulnerability management.
• Produce audit reports, dashboards, and presentations for technical and executive audiences.
• Partner with IT, security and business teams to drive remediation and continuous improvement.

Skills

Security auditing

Risk assessments

Compliance frameworks

GRC platforms

Audit tools

Communication

Education

Bachelor's degree in IT or Cybersecurity

Tools

AuditBoard

Drata

Splunk

Qualys

AWS Security Hub

Job description

Why join Coupa?

Coupa makes margins multiply through its community-generated AI and industry-leading total spend management platform for businesses large and small. Coupa AI is informed by trillions of dollars of direct and indirect spend data across a global network of 10M+ buyers and suppliers. We empower you with the ability to predict, prescribe, and automate smarter, more profitable business decisions to improve operating margins.

• Pioneering Technology: At Coupa, we're at the forefront of innovation, leveraging the latest technology to empower our customers with greater efficiency and visibility in their spend.
• Collaborative Culture: We value collaboration and teamwork, and our culture is driven by transparency, openness, and a shared commitment to excellence.
• Global Impact: Join a company where your work has a global, measurable impact on our clients, the business, and each other.

Learn more on Life at Coupa blog and hear from our employees about their experiences working at Coupa.

The Impact of an IT Security, Risk, and Compliance Auditor at Coupa:

The IT Security, Risk, and Compliance Auditor plays a critical role in evaluating, strengthening, and automating the organization's security controls, risk posture, and compliance frameworks. This position is responsible for conducting technical security audits, implementing automated control testing, identifying gaps, and enhancing compliance processes to drive operational efficiency and risk reduction.

The ideal candidate has a technical background in security and compliance auditing with a strong understanding of control automation, evidence collection automation, and continuous compliance monitoring. They will work cross-functionally with IT, security, and business units to evaluate the effectiveness of security measures, improve control design, and ensure the organization meets regulatory and industry standards.

This role requires proficiency in security frameworks such as ISO 27001, SOC 2, PCI DSS, HIPAA, SWIFT, TISAX, C5, PIMS, NIST CSF, FedRAMP, and expertise in automation tools, GRC platforms, and evidence collection technologies.

What You'll Do:

• Conduct Technical Audits & Risk Assessments: Perform in-depth security audits and risk-based assessments of infrastructure, applications, and cloud environments to evaluate compliance with standards like ISO 27001, SOC 2, PCI DSS, GDPR, and HIPAA.
• Leverage Automation & Tools: Utilize automated control testing, evidence collection, and real-time compliance tracking via GRC platforms and security tools (e.g., SIEM, IAM, vulnerability management).
• Evaluate & Improve Security Controls: Assess and validate security configurations, access management, encryption, and vulnerability management, providing risk-based recommendations and supporting mitigation efforts.
• Reporting & Stakeholder Engagement: Produce detailed audit reports, dashboards, and presentations for technical and executive audiences, tracking remediation and ensuring audit follow-ups are completed.
• Cross-Functional Collaboration & Advisory: Partner with IT, security, and business teams to integrate audit findings into strategy, advise on best practices, and support continuous improvement in control automation and compliance posture.

What You Will Bring to Coupa:

• Education & Experience: Bachelor's degree in IT, Cybersecurity, or related field (or equivalent experience) with 3+ years in IT security auditing, technical risk assessments, or compliance.
• Technical & Framework Expertise: Strong knowledge of security frameworks (e.g., ISO 27001, SOC 2, PCI DSS, NIST CSF, HIPAA, FedRAMP) and understanding of IT systems, cloud security, encryption, and access management.
• Tools & Automation: Experience with GRC platforms, compliance automation, control testing tools, evidence collection systems, and familiarity with audit/security tools (e.g., AuditBoard, Drata, Splunk, Qualys, AWS Security Hub).
• Certifications (Preferred): CISA, CISSP, CRISC, CISM, ISO 27001 Lead Auditor, or equivalent credentials.
• Communication & Analytical Skills: Strong verbal and written communication skills, with the ability to translate findings into actionable security recommendations and engage effectively with stakeholders.

At Coupa, we are 100% committed to creating and nurturing an environment that supports your physical, mental, and community well-being. We offer a comprehensive suite of benefits designed to help you and your family thrive:

Global Well-Being Perks (For All Employees Globally)

• Global Wellness Days: Enjoy two designated, company-wide paid wellness days off each year (typically the first Friday in March and the last Friday in September) so the entire global team can unplug, step away, and recharge together.
• Birthday Time-Off: Celebrate your day! Coupa provides a paid day off on your birthday or another day of your choice within your birthday month.
• Volunteer Time Off (VTO): Giving back is in our DNA. We offer 40 hours of paid VTO annually to support the community initiatives and volunteer programs you are passionate about.
• Employee Assistance Program (EAP): Access free, confidential, 24/7/365 counseling and resources for emotional support, work-life solutions, financial advice, legal guidance, and support for new parents.
• Business Travel Protection: Travel with peace of mind. Zurich Travel Assist provides medical, safety, pre-trip planning, and emergency support during any business travel.
• Referral Bonus Program: Share the Coupa experience! Receive generous monetary referral bonuses when you successfully refer talented friends or acquaintances who are hired into open roles.

Please note: In addition to these global well-being perks, Coupa offers highly competitive, location-specific benefits packages (which include comprehensive medical/dental insurance, retirement/pension plans, and life or accident protection) tailored to your primary work location. Your recruiter will walk you through the specific regional benefits package for this role during the interview process.

Coupa complies with relevant laws and regulations regarding equal opportunity and offers a welcoming and inclusive work environment. Decisions related to hiring, compensation, training, or evaluating performance are made fairly, and we provide equal employment opportunities to all qualified candidates and employees.