Security Compliance Specialist II

Jobgether; United States; A distancia; USD 85.000 - 120.000; Jornada completa

Descripción de la vacante

Jobgether is seeking a Security Compliance Specialist to join our global security team. You will conduct control testing, assess design and operational effectiveness, and coordinate evidence for SOC 2, ISO 27001, PCI DSS, and other frameworks.

You will partner with Engineering, DevOps, IT, and business units to ensure controls are implemented and audit-ready. The role emphasizes risk identification, remediation planning, and cross-functional collaboration, with a focus on continuous improvement

Formación

• 2–6 years of information security, security compliance, or IT auditing experience.
• Experience assessing security controls against SOC 2, ISO 27001, PCI DSS.
• Strong IAM, Change Management, Vulnerability Management, Logging, and Monitoring knowledge.
• Experience evaluating control design and evidence for audits.
• Familiarity with governance, risk, and compliance (GRC) tools.
• Excellent analytical, written and verbal communication skills.
• Ability to work with cross-functional teams and manage multiple audits.

Responsabilidades

• Support security compliance programs through control testing and risk evaluation.
• Perform design and operational effectiveness assessments against SOC 2, ISO 27001, PCI DSS.
• Coordinate evidence collection and prepare audit materials.
• Lead technical discussions with Engineering, DevOps, IT, and system owners.
• Coordinate sampling, review documentation, validate evidence.
• Identify risks, gaps, and remediation across GRC platforms.
• Support third-party audits and minimize disruption.
• Drive process optimization and automation in compliance activities.

Conocimientos

Security compliance

Audit coordination

Risk assessment

GRC tools

Technical security controls

Cloud / container tech

Analytical skills

Communication

Collaboration

Adaptability

Educación

CISA

CRISC

Security+

ISO 27001 Lead Auditor

Herramientas

GRC platforms

Descripción del empleo

Accountabilities:

- Security Compliance Management: Support security compliance programs by conducting control testing, evaluating risks, identifying control deficiencies, and contributing to continuous improvements across the organization's security framework.

- Security Control Assessments: Perform design and operational effectiveness assessments of technical, physical, and organizational security controls against standards such as SOC 2, ISO 27001, PCI DSS, and other relevant frameworks.

- Technical Control Evaluation: Assess the effectiveness of security controls related to Identity and Access Management (IAM), Change Management, Vulnerability Management, Logging, and Monitoring.

- Audit Coordination: Support internal and external audits by coordinating evidence collection, managing documentation, preparing audit materials, and ensuring timely completion of compliance activities.

- Technical Walkthroughs: Organize and lead technical discussions with Engineering, DevOps, IT, and system owners to understand security processes, validate control implementation, and review supporting evidence.

- Evidence Review and Validation: Coordinate sampling populations, examine technical documentation, validate control evidence, and ensure that compliance requirements are adequately demonstrated.

- Risk and Gap Identification: Identify control weaknesses, document exceptions and recurring trends within GRC platforms, and collaborate with relevant stakeholders to address compliance gaps.

- Remediation Management: Develop actionable remediation plans, coordinate corrective actions with system owners, and monitor progress to ensure identified deficiencies are resolved.

- Third-Party Audit Support: Facilitate external compliance assessments by coordinating evidence requests, explaining technical controls to auditors, and minimizing operational disruption throughout the audit process.

- Process Optimization: Identify opportunities to streamline compliance activities, improve audit readiness, and enhance operational efficiency through automation and effective use of GRC tools.

- Cross-Functional Collaboration: Partner with security, engineering, infrastructure, and business teams to strengthen security practices and maintain alignment with industry standards and organizational requirements.

Requirements:

- Professional Experience: 2–6 years of relevant experience in information security, security compliance, IT auditing, risk management, or a related field.

- Security Compliance Frameworks: Practical experience assessing security controls against recognized industry standards, particularly SOC 2, ISO 27001, and PCI DSS.

- Technical Security Knowledge: Strong understanding of technical security controls, including Identity and Access Management, Change Management, Vulnerability Management, Logging, and Monitoring.

- Control Testing and Auditing: Experience evaluating control design and operational effectiveness, reviewing technical evidence, identifying gaps, and supporting internal or external audits.

- Risk Assessment: Ability to identify security risks, assess control deficiencies, document exceptions, and recommend appropriate remediation measures.

- GRC Platforms: Familiarity with governance, risk, and compliance tools for managing audit evidence, tracking exceptions, documenting findings, and monitoring remediation activities.

- Cloud and Infrastructure Knowledge: Exposure to cloud infrastructure, containerized environments, or distributed systems is considered an advantage.

- Audit and Security Certifications: Certifications such as CISA, CRISC, Security+, CISM, or ISO 27001 Lead Auditor are advantageous but not mandatory.

- Analytical Skills: Excellent analytical, critical-thinking, and problem-solving abilities, with strong attention to detail and the ability to investigate complex technical and compliance issues.

- Communication Skills: Strong written and verbal communication skills, including the ability to explain technical security controls and compliance requirements to both technical and non-technical stakeholders.

- Collaboration: Ability to work effectively with cross-functional teams, coordinate multiple audit activities, and build productive relationships with system owners and business stakeholders.

- Adaptability: A proactive and organized approach to managing competing priorities, meeting deadlines, and contributing to continuous improvements in a dynamic technology environment.

Benefits:

- Fully remote working arrangement in India, with flexibility to work from home, an office, or a combination depending on role requirements.

- Flexible working approach designed to support employee productivity and individual working preferences.

- Comprehensive benefits supporting physical health, mental well-being, financial security, and personal needs.

- Opportunities to work with cutting-edge web security, cloud, and edge computing technologies.

- Exposure to internationally recognized security and compliance frameworks, including SOC 2, ISO 27001, FedRAMP, and PCI DSS.

- Collaboration with experienced global security, engineering, and compliance professionals.

- Opportunities to strengthen expertise in information security, risk management, auditing, and GRC operations.

- Professional development and continuous learning opportunities within a global technology environment.

- The opportunity to contribute to security initiatives protecting large-scale digital infrastructure and services used worldwide.