Job Description:
- Hands-on experience in SOC 2 Type I and Type II implementation/readiness and delivery.
- Strong understanding of AICPA Trust Services Criteria (TSC).
- Experience with control mapping, gap assessments, evidence collection and validation.
- Understanding of Type II observation periods, control operating effectiveness and exceptions.
- Experience coordinating with external auditors/CPA firms.
- Ability to manage SOC 2 engagements from kickoff through audit closure.
2. ISO 27001 Expertise
- Strong understanding of ISO/IEC 27001:2022 requirements.
- Experience implementing and maintaining an Information Security Management System (ISMS).
- Conducting ISO 27001 gap assessments and readiness assessments.
- Understanding of Annex A controls and applicability assessment.
- Experience with:
- Risk assessment and risk treatment
- Statement of Applicability (SoA)
- Information security policies and procedures
- Internal audits
- Management reviews
- Corrective actions / NC management
- Continual improvement
- ISMS metrics and monitoring
- Experience supporting organizations through ISO 27001 certification audits.
- Understanding of Stage 1 and Stage 2 audit processes.
3. Governance, Risk & Compliance (GRC)
- Strong understanding of GRC frameworks and principles.
- Ability to establish and maintain governance processes.
- Experience with:
- Risk management
- Control frameworks
- Compliance assessments
- Regulatory requirements
- Policy governance
- Exception management
- Risk acceptance
- Corrective and preventive actions
- Compliance monitoring
- Ability to map controls across multiple frameworks such as SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, etc.
4. Compliance & Audit Management
- Manage internal and external compliance assessments.
- Prepare organizations for certification and attestation audits.
- Develop audit plans, evidence trackers and compliance calendars.
- Review audit evidence for completeness and adequacy.
- Manage audit observations, non-conformities and corrective actions.
- Coordinate with auditors and stakeholders to resolve audit queries.
- Maintain appropriate audit trails and compliance documentation.
5. Risk Management
- Conduct information security risk assessments.
- Identify, assess and prioritize organizational risks.
- Develop Risk Treatment Plans (RTPs).
- Maintain risk registers.
- Evaluate residual risk and risk acceptance.
- Support business owners in implementing appropriate risk mitigation measures.
6. Policies & Documentation
Candidate should be comfortable creating/reviewing:
- Information Security Policy
- ISMS documentation
- Risk Management Policy
- Access Control Policy
- Incident Management Policy
- Business Continuity/DR policies
- Vendor Risk Management Policy
- Change Management Policy
- Secure SDLC policies
- Data Protection/Privacy policies
- Business Continuity documentation
- Control procedures and work instructions
7. Client & Stakeholder Management
- Conduct client discovery and kickoff meetings.
- Understand business processes, technology environments and compliance requirements.
- Act as the primary delivery contact for clients.
- Conduct regular status meetings.
- Track milestones, dependencies, risks and deliverables.
- Communicate compliance requirements clearly to technical and non-technical stakeholders.
- Manage escalations and ensure timely closure of deliverables.
8. Technical Security Understanding
Candidate should have a good working understanding of:
- AWS / Azure / GCP
- IAM, SSO and MFA
- Vulnerability management
- Secure SDLC
- Change management
- Incident response
- Logging and monitoring
- Encryption
- Backup and DR
- Endpoint security
- Network security
- Asset management
- Vendor/third-party security
- Data protection
They don’t need to be a penetration tester or security engineer, but should be able to understand technical controls and assess their compliance implications.
Key Skills
Must Have:
- SOC 2 Type I/II
- ISO 27001:2022
- ISMS implementation
- GRC
- Risk assessment & treatment
- Control assessment
- Audit management
- Evidence review
- Compliance management
- Policy/procedure development
- Client management
- Strong documentation and communication skills
Good to Have:
- CISA / CISSP / CRISC
- ISO 27001 Lead Auditor / Lead Implementer
- ISO 27701
- PCI DSS
- HIPAA
- GDPR
- NIST CSF / NIST 800-53
- CSA CCM
- Experience with GRC platforms such as Vanta, Drata, Secureframe, OneTrust, etc.
