[8PP] Compliance Specialist

We are looking for an experienced Information Security Governance, Risk, and Compliance Specialist to support our security and compliance initiatives. The primary focus of this role will be facilitating the organization’s 2026 SOC 1 and SOC 2 audits, along with supporting policy management, enterprise risk, and vendor risk activities.

This role involves working across Security, IT, Operations, Finance, Legal, and Procurement to coordinate external audits, maintain security policies, manage enterprise and vendor risks, and strengthen the organization’s overall compliance program.

Information Security Policy Management

• Manage the lifecycle of Information Security policies, including reviews, updates, approvals, publication, and version control.
• Coordinate urgent policy changes and annual policy review cycles.
• Maintain policy records and approval documentation to support governance and audit readiness.
• Track outstanding actions and improve policy management workflows, templates, and review processes.

External Audit Coordination

• Coordinate the annual SOC 1 and SOC 2 attestation processes and other external audits.
• Manage audit timelines, evidence collection, documentation, stakeholder coordination, and auditor requests.
• Partner with control owners to validate control performance and address findings, exceptions, and remediation activities.
• Maintain audit evidence repositories and support the preparation of control descriptions, management narratives, and responses.
• Escalate significant risks, control gaps, and audit blockers to the CISO and relevant leadership.

Security Risk Management

• Support risk intake, assessment, documentation, tracking, and reporting.
• Maintain risk registers and workflows within Full Circle, UpGuard, Drata, Vanta, or similar GRC platforms.
• Track remediation plans, target dates, control gaps, and overdue actions.
• Prepare risk dashboards, metrics, and status reports for leadership.
• Improve risk scoring, reporting, workflows, and platform utilization.

Vendor Risk Management

• Manage third-party risk assessments, due diligence, and ongoing vendor monitoring.
• Review vendor security documentation and track remediation activities.
• Collaborate with Procurement, Legal, IT, and business teams on onboarding and renewal decisions.
• Escalate critical vendor risks, exceptions, and unresolved concerns.

• Experience supporting SOC 1 and SOC 2 audits, including evidence collection, control validation, and auditor coordination.
• Experience with information security policies, enterprise risk management, and vendor risk assessments.
• Background working in software-driven environments involving cloud applications and SaaS platforms.
• Experience with GRC platforms such as Full Circle, UpGuard, Drata, or Vanta.
• Strong organizational, communication, and stakeholder-management skills.
• Ability to manage multiple priorities independently and handle sensitive information with discretion.
• CISSP, CRISC, or CISA certification.

#LI-DNI

Nice to Have

• Hands-on experience with Full Circle or UpGuard, particularly for risk assessments.
• SaaS, cloud security, or compliance certifications.

This is expected to be a short-term engagement through the end of 2026