Security Compliance Specialist

Harris Computer; Atlanta (GA); On-site; USD 80,000 - 90,000; Full time

Benefits offered by this job

Health benefits

RRSP matching

Stock option

Career development opportunities

Job summary

Harris Computer seeks a Security & Compliance Advisor to guide certification readiness across SOC 2, ISO 27001, PCI DSS, HIPAA, and Nacha. You will advise on controls, review evidence, and help scope shared services with auditors.

In this role you’ll coordinate with internal audit teams and corporate functions, document gaps, and propose remediation plans to ensure audit success and regulatory compliance.

Qualifications

• Three or more years of relevant experience assessing security and compliance requirements, including hands-on evaluation of technical security controls and supporting audits, assessments, or certification-readiness activities.
• Experience advising on security controls required for SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, and Nacha requirements.
• Familiarity with common security evidence requirements referenced during audits (e.g., patching reports, password settings, penetration test results).
• Understanding of inclusive vs. carve-out scoping considerations for shared services or third-party relationships from a security perspective.
• Experience coordinating with internal audit teams, external auditors, and corporate support functions during audit, assessment, and certification processes.
• Understanding of documentation standards expected for internal audits, business continuity, disaster recovery, and penetration testing activities.
• Experience evaluating the design, implementation, and operating effectiveness of administrative and technical security controls and clearly documenting identified gaps.

Responsibilities

• Advise on security requirements and provide guidance for certification readiness across frameworks (SOC 2, ISO 27001, PCI DSS, HIPAA, Nacha).
• Review security documentation, policies, and procedures for completeness and alignment with certification requirements.
• Identify gaps and remediation steps prior to external audits.
• Advise on proactive evidence collection and manage evidence gathering timelines.
• Provide documentation standards guidance for audit-related meetings and evidence collection.
• Offer security-focused input on shared services and third-party scoping within audit scope.
• Recommend security controls and configurations frequently requested as audit evidence.
• Coordinate with internal audit teams, external auditors, and corporate support functions throughout audits and assessments.

Skills

Attention to Detail

Analytical Thinking

Communication Proficiency

Advisory/Consultative Skills

Collaboration

Project Coordination

Education

Bachelor's degree in Information Security, Computer Science, or related field

Job description

WHAT YOU WILL DO

Security Guidance for Certification Readiness
Advises business units on security requirements applicable to their certification, attestation, assessment, or regulatory scope (e.g., SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, and applicable Nacha requirements)Reviews security documentation, policies, and procedures for completeness and alignment with certification requirements and other applicable security and compliance obligationsIdentifies security-related gaps that may need remediation prior to an external auditAdvises on proactive evidence collection, since evidence requests often begin broad (e.g., lists of computers or projects) before narrowing to specific items (e.g., a specific workstation or project); encourages early and continuous evidence gathering rather than waiting for detailed requestsDocumentation Standards Guidance
Advises businesses that meetings related to internal audits, business continuity, disaster recovery, and external penetration tests should be well documented with agendas and minutes to support evidence collection during audits and assessmentsReviews documentation practices to confirm they will hold up to auditor scrutiny from a security perspectiveShared Services & Third-Party Scoping
Provides security-focused input on how shared services and corporate/administrative support functions (such as centralized IT, HR, finance, or legal services provided by a parent or corporate entity) should be classified within the audit scope—specifically whether the relationship should be treated as
inclusive
or
carve-outAdvises on scenarios where a business unit relies on a shared services provider for security-relevant reporting it cannot generate independently (e.g., workstation patching reports or password settings), which typically indicates an inclusive scoping approach rather than carve‑outRecommends involving the shared services provider (e.g., a Corporate IT function) as early as possible in the audit, assessment, or certification process, since certain evidence requests—such as workstation lists, vulnerability scan reports, or patching audit logs—may require lead time to fulfillSecurity Control Recommendations
Recommends security controls and improvements needed to satisfy the requirements of the applicable frameworkProvides guidance on password settings, patching cadence, and other technical security configurations commonly requested as audit evidenceReviews penetration test scope and results from a security standpoint to determine whether they provide appropriate evidence for applicable audit, assessment, or certification requirementsAudit Coordination Support
Works in coordination with the business unit's internal audit team and external auditors throughout the audit, assessment, or certification processParticipates in audit planning discussions to ensure security evidence and controls are appropriately representedSupports communication between the business unit and any shared services or corporate support functions needed to fulfill audit evidence requestsAssists in tracking security-related audit findings through to remediation and closureCollaborates with corporate support functions (IT, HR, Finance, Legal) when their services fall within the audit scope, ensuring timely delivery of required reports and documentation

WHAT WILL MAKE YOU STAND OUT

Attention to DetailAnalytical ThinkingCommunication ProficiencyAdvisory/Consultative SkillsCollaborationProject Coordination

WHAT ARE WE LOOKING FOR

Security & Compliance Experience
Three or more years of relevant experience assessing security and compliance requirements, including hands‑on evaluation of technical security controls and supporting audits, assessments, or certification‑readiness activities.Experience advising on security controls required for SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, and Nacha requirementsFamiliarity with common security evidence requirements referenced during audits (e.g., patching reports, password settings, penetration test results)Understanding of inclusive vs. carve‑out scoping considerations for shared services or third‑party relationships from a security perspectiveExperience coordinating with internal audit teams, external auditors, and corporate support functions during audit, assessment, and certification processesDocumentation & Standards Knowledge
Understanding of documentation standards expected for internal audits, business continuity, disaster recovery, and penetration testing activitiesExperience evaluating the design, implementation, and operating effectiveness of administrative and technical security controls and clearly documenting identified gaps

REQUIRED TRAINING AND EDUCATION

Bachelor's degree in Information Security, Computer Science, or related fieldEquivalent work experience may substitute for degree requirement

PREFERRED CERTIFICATIONS

CISSP (Certified Information Systems Security Professional)ISO 27001 Lead ImplementerCISA (Certified Information Systems Auditor)PCIP (Payment Card Industry Professional) and willingness and ability to obtain PCI ISA (Internal Security Assessor) after hire if PCI DSS responsibilities are assigned

KEY DELIVERABLES

Security gap analysis reportsSecurity control recommendations for audit readinessGuidance documentation on evidence types typically requested by auditorsSecurity‑focused scoping recommendations for shared services relationshipsCoordination notes/reports supporting audit evidence collection timelines

COMPENSATION DETAILS

The potential salary range for this role is $80,000 to $90,000 per year, with eligibility for bonus or merit program. Final compensation will be based on experience, skills, market conditions, and internal equity. We offer a competitive Total Rewards program including health benefits, RRSP matching, stock option, and career development opportunities.