SOC 2 Compliance Engineer for Cloud & IAM

Jobtailor; California (MO); Hybrid; USD 90,000 - 150,000; Full time

Job summary

Jobtailor seeks a security/compliance specialist to lead SOC 2 Type I/II audits, develop policy automation, and maintain evidence repositories. You will collaborate with IT, security, and engineering to implement compliant, scalable controls across cloud services.

The role requires hands-on experience with cloud infrastructure, IAM, and CI/CD tooling, plus strong communication skills to translate technical risk to stakeholders.

Qualifications

• 2–5 years of experience in technical compliance, IT audit, or GRC within a SaaS or startup
• Proven end-to-end experience supporting external SOC 2 Type I and II audits
• Expertise auditing IT General Controls (ITGC) including Change Management, Logical Access, and System Operations
• Strong understanding of cloud infrastructure (AWS/GCP/Azure), IAM, CI/CD pipelines, encryption standards, and vulnerability management
• Ability to read a Terraform plan or an AWS Config rule and interpret its compliance impact
• Experience operating Vanta or Drata
• Experience tracking work in Jira
• Experience with KnowBe4 or a security awareness platform
• Exceptional written and verbal communication skills
• Ability to explain technical controls to customers and business risks to engineers

Responsibilities

• Draft technically precise responses to RFPs, security questionnaires, and customer portals
• Own and update the audit-ready repository of security evidence, configurations, and policies
• Retrieve technical evidence on AWS KMS encryption, logging pipelines, and IAM paths
• Partner with IT, Security, Product, Engineering, and Delivery on compliance-by-design decisions
• Write, update, and operationalize security policies and translate controls into developer tasks
• Automate policy enforcement in CI/CD pipelines
• Conduct compliance enablement sessions for engineering teams
• Coordinate SOC 2 Type I and II audit cycles across entities
• Manage audit schedules, external auditors, and remediation of findings
• Automate evidence collection and monitor controls using Vanta and Drata
• Manage the Jira compliance ticketing queue
• Execute quarterly User Access Reviews, security awareness training, phishing simulations, and risk processes
• Build and maintain compliance KPI/KRI dashboards and report audit readiness
• Manage annual policy review and attestation cycles
• Assist with alignment to NIST SP 800-53, NIST SP 800-171 Rev 3, FedRAMP, and CMMC 2.0
• Draft early System Security Plans and Plans of Action & Milestones
• Own third-party vendor reviews for cloud, HRIS, and CRM providers
• Support security incidents by preserving evidence and drafting post-incident reports

Skills

Technical Compliance

IT Audit

GRC

IAM

Encryption Standards

Vulnerability Management

Audit Readiness

Security Policy Development

Communication

Tools

Jira

Vanta

Drata

KnowBe4

Terraform

AWS Config

Job description

Jobtailor seeks a security/compliance specialist to lead SOC 2 Type I/II audits, develop policy automation, and maintain evidence repositories. You will collaborate with IT, security, and engineering to implement compliant, scalable controls across cloud services.

The role requires hands-on experience with cloud infrastructure, IAM, and CI/CD tooling, plus strong communication skills to translate technical risk to stakeholders.