Technical Compliance Analyst

Jobtailor; California (MO); Hybrid; USD 90,000 - 150,000; Full time

Job summary

Jobtailor seeks a security/compliance specialist to lead SOC 2 Type I/II audits, develop policy automation, and maintain evidence repositories. You will collaborate with IT, security, and engineering to implement compliant, scalable controls across cloud services.

The role requires hands-on experience with cloud infrastructure, IAM, and CI/CD tooling, plus strong communication skills to translate technical risk to stakeholders.

Qualifications

• 2–5 years of experience in technical compliance, IT audit, or GRC within a SaaS or startup
• Proven end-to-end experience supporting external SOC 2 Type I and II audits
• Expertise auditing IT General Controls (ITGC) including Change Management, Logical Access, and System Operations
• Strong understanding of cloud infrastructure (AWS/GCP/Azure), IAM, CI/CD pipelines, encryption standards, and vulnerability management
• Ability to read a Terraform plan or an AWS Config rule and interpret its compliance impact
• Experience operating Vanta or Drata
• Experience tracking work in Jira
• Experience with KnowBe4 or a security awareness platform
• Exceptional written and verbal communication skills
• Ability to explain technical controls to customers and business risks to engineers

Responsibilities

• Draft technically precise responses to RFPs, security questionnaires, and customer portals
• Own and update the audit-ready repository of security evidence, configurations, and policies
• Retrieve technical evidence on AWS KMS encryption, logging pipelines, and IAM paths
• Partner with IT, Security, Product, Engineering, and Delivery on compliance-by-design decisions
• Write, update, and operationalize security policies and translate controls into developer tasks
• Automate policy enforcement in CI/CD pipelines
• Conduct compliance enablement sessions for engineering teams
• Coordinate SOC 2 Type I and II audit cycles across entities
• Manage audit schedules, external auditors, and remediation of findings
• Automate evidence collection and monitor controls using Vanta and Drata
• Manage the Jira compliance ticketing queue
• Execute quarterly User Access Reviews, security awareness training, phishing simulations, and risk processes
• Build and maintain compliance KPI/KRI dashboards and report audit readiness
• Manage annual policy review and attestation cycles
• Assist with alignment to NIST SP 800-53, NIST SP 800-171 Rev 3, FedRAMP, and CMMC 2.0
• Draft early System Security Plans and Plans of Action & Milestones
• Own third-party vendor reviews for cloud, HRIS, and CRM providers
• Support security incidents by preserving evidence and drafting post-incident reports

Skills

Technical Compliance

IT Audit

GRC

IAM

Encryption Standards

Vulnerability Management

Audit Readiness

Security Policy Development

Communication

Tools

Jira

Vanta

Drata

KnowBe4

Terraform

AWS Config

Job description

Responsibilities

• Draft technically precise responses to RFPs, security questionnaires, and customer portals
• Own and continuously update the audit-ready repository of security evidence, technical configurations, and policy documents
• Retrieve technical evidence on AWS KMS encryption, logging pipelines, and IAM privilege escalation paths
• Partner with IT, Security, Product, Engineering, and Delivery on compliance-by-design architectural decisions
• Write, update, and operationalize security policies and translate SOC 2/NIST controls into developer-friendly tasks
• Automate policy enforcement in CI/CD pipelines
• Conduct compliance enablement sessions for engineering teams
• Coordinate end-to-end SOC 2 Type I and Type II audit cycles across business entities
• Manage audit schedules, external auditors, and remediation of findings
• Automate evidence collection and monitor technical controls using Vanta and Drata
• Manage the Jira compliance ticketing queue
• Execute quarterly User Access Reviews, security awareness training, phishing simulations, and Risk Acceptance/Exception processes
• Build and maintain compliance KPI/KRI dashboards and report audit readiness, remediation SLAs, and control health trends
• Manage annual policy review and attestation cycles
• Assist with alignment to NIST SP 800-53, NIST SP 800-171 Rev 3, FedRAMP, and CMMC 2.0
• Draft early System Security Plans and Plans of Action & Milestones
• Own third-party vendor reviews for cloud, HRIS, and CRM providers
• Support security incidents by preserving evidence, documenting event chronology, and drafting post-incident reports

Requirements

• 2–5 years of experience in technical compliance, IT audit, or GRC within a SaaS or fast-paced startup environment
• Proven end-to-end experience supporting external SOC 2 Type I and Type II audits
• Expertise auditing IT General Controls (ITGC), including Change Management, Logical Access, and System Operations
• Strong understanding of modern cloud infrastructure (AWS/GCP/Azure), IAM, CI/CD pipelines, encryption standards, and vulnerability management
• Ability to read a Terraform plan or an AWS Config rule and interpret its compliance impact
• Experience operating Vanta or Drata
• Experience tracking work in Jira
• Experience with KnowBe4 or a security awareness platform
• Exceptional written and verbal communication skills
• Ability to explain technical controls to customers and business risks to engineers

Core Competencies

Demonstrates expertise in technical compliance and IT audit processes, with a strong focus on SOC 2 Type I and Type II audits, cloud infrastructure compliance, and policy automation. Proficient in managing compliance documentation, conducting training sessions, and collaborating with cross-functional teams to ensure adherence to security standards.

Highest-signal resume keywords

• SOC 2 Type I And Type II Audit Experience
• AWS KMS Encryption
• CI/CD Pipeline Automation
• Vanta Or Drata Experience
• Technical Compliance Management

ATS Optimization Keywords

Hard Skills

• Technical Compliance
• IT Audit
• GRC
• IAM
• Encryption Standards
• Vulnerability Management
• Terraform
• AWS Config
• Audit Readiness
• Security Policy Development

Soft Skills

• Exceptional Written Communication
• Verbal Communication
• Collaboration
• Training Facilitation
• Problem-Solving

Industry Keywords

• NIST SP 800-53
• NIST SP 800-171 Rev 3
• FedRAMP
• CMMC 2.0
• IT General Controls

Tools & Technologies

• Jira
• Vanta
• Drata
• KnowBe4
• Cloud Infrastructure