SaaS Compliance & Audit Specialist

Harvey, Inc.; San Francisco (CA); Hybrid; USD 99,000 - 181,000; Full time

Job summary

Harvey, Inc. is seeking an experienced information security compliance professional to own and maintain core compliance documentation and security assessment reports.

You will coordinate evidence collection across Engineering, Infrastructure, and Security for regulated assessments and support third‑party assessor engagements end‑to‑end. This role requires mapping controls to technical implementations, evaluating evidence quality, and maintaining remediation tracking with a focus on continuous

Qualifications

• 3–5+ years of information security compliance experience
• Experience with government and industry frameworks in SaaS/cloud environments
• Ability to map controls to technical implementations and evaluate evidence quality
• Experience maintaining compliance documentation and remediation tracking
• Ability to communicate compliance requirements to engineering teams

Responsibilities

• Own and maintain core compliance documentation and security assessment reports
• Coordinate evidence collection for regulated assessments across teams
• Support third‑party assessor engagements from scheduling to remediation responses
• Conduct gap analyses against applicable frameworks and produce remediation artifacts
• Manage continuous monitoring activities including control reviews and incident documentation
• Collaborate with Engineering and Security to validate control implementations and translate regulatory language into testable configurations

Skills

Information security

Regulatory frameworks

Documentation

Cross-functional collaboration

Education

Degrees in information security or related field

Tools

Compliance automation tooling

Job description

Harvey, Inc. is seeking an experienced information security compliance professional to own and maintain core compliance documentation and security assessment reports.

You will coordinate evidence collection across Engineering, Infrastructure, and Security for regulated assessments and support third‑party assessor engagements end‑to‑end. This role requires mapping controls to technical implementations, evaluating evidence quality, and maintaining remediation tracking with a focus on continuous