Sr. consultant - compliance

Job Description:

Hands-on experience in SOC 2 Type I and Type II implementation/readiness and delivery. Strong understanding of AICPA Trust Services Criteria (TSC). Experience with control mapping, gap assessments, evidence collection and validation. Understanding of Type II observation periods, control operating effectiveness and exceptions. Experience coordinating with external auditors/CPA firms. Ability to manage SOC 2 engagements from kickoff through audit closure.

2. ISO 27001 Expertise

Strong understanding of ISO/IEC 27001:2022 requirements. Experience implementing and maintaining an Information Security Management System (ISMS). Conducting ISO 27001 gap assessments and readiness assessments. Understanding of Annex A controls and applicability assessment. Experience with: Risk assessment and risk treatment Statement of Applicability (So A) Information security policies and procedures Internal audits Management reviews Corrective actions / NC management Continual improvement ISMS metrics and monitoring Experience supporting organizations through ISO 27001 certification audits. Understanding of Stage 1 and Stage 2 audit processes.

3. Governance, Risk & Compliance (GRC)

Strong understanding of GRC frameworks and principles. Ability to establish and maintain governance processes. Experience with: Risk management Control frameworks Compliance assessments Regulatory requirements Policy governance Exception management Risk acceptance Corrective and preventive actions Compliance monitoring Ability to map controls across multiple frameworks such as SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, etc.

4. Compliance & Audit Management

Manage internal and external compliance assessments. Prepare organizations for certification and attestation audits. Develop audit plans, evidence trackers and compliance calendars. Review audit evidence for completeness and adequacy. Manage audit observations, non-conformities and corrective actions. Coordinate with auditors and stakeholders to resolve audit queries. Maintain appropriate audit trails and compliance documentation.

5. Risk Management

Conduct information security risk assessments. Identify, assess and prioritize organizational risks. Develop Risk Treatment Plans (RTPs). Maintain risk registers. Evaluate residual risk and risk acceptance. Support business owners in implementing appropriate risk mitigation measures.

6. Policies & Documentation

Candidate should be comfortable creating/reviewing:

Information Security Policy ISMS documentation Risk Management Policy Access Control Policy Incident Management Policy Business Continuity/DR policies Vendor Risk Management Policy Change Management Policy Secure SDLC policies Data Protection/Privacy policies Business Continuity documentation Control procedures and work instructions

7. Client & Stakeholder Management

Conduct client discovery and kickoff meetings. Understand business processes, technology environments and compliance requirements. Act as the primary delivery contact for clients. Conduct regular status meetings. Track milestones, dependencies, risks and deliverables. Communicate compliance requirements clearly to technical and non-technical stakeholders. Manage escalations and ensure timely closure of deliverables.

8. Technical Security Understanding

Candidate should have a good working understanding of:

AWS / Azure / GCP IAM, SSO and MFA Vulnerability management Secure SDLC Change management Incident response Logging and monitoring Encryption Backup and DR Endpoint security Network security Asset management Vendor/third-party security Data protection

They don't need to be a penetration tester or security engineer, but should be able to understand technical controls and assess their compliance implications.

Key Skills

Must Have:

SOC 2 Type I/II ISO 27001:2022 ISMS implementation GRC Risk assessment & treatment Control assessment Audit management Evidence review Compliance management Policy/procedure development Client management Strong documentation and communication skills

Good to Have:

CISA / CISSP / CRISC ISO 27001 Lead Auditor / Lead Implementer ISO 27701 PCI DSS HIPAA GDPR NIST CSF / NIST 800-53 CSA CCM Experience with GRC platforms such as Vanta, Drata, Secureframe, One Trust, etc.