Security Compliance Specialist II

Accountabilities:

• Security Compliance Management: Support security compliance programs by conducting control testing, evaluating risks, identifying control deficiencies, and contributing to continuous improvements across the organization's security framework.
• Security Control Assessments: Perform design and operational effectiveness assessments of technical, physical, and organizational security controls against standards such as SOC 2, ISO 27001, PCI DSS, and other relevant frameworks.
• Technical Control Evaluation: Assess the effectiveness of security controls related to Identity and Access Management (IAM), Change Management, Vulnerability Management, Logging, and Monitoring.
• Audit Coordination: Support internal and external audits by coordinating evidence collection, managing documentation, preparing audit materials, and ensuring timely completion of compliance activities.
• Technical Walkthroughs: Organize and lead technical discussions with Engineering, DevOps, IT, and system owners to understand security processes, validate control implementation, and review supporting evidence.
• Evidence Review and Validation: Coordinate sampling populations, examine technical documentation, validate control evidence, and ensure that compliance requirements are adequately demonstrated.
• Risk and Gap Identification: Identify control weaknesses, document exceptions and recurring trends within GRC platforms, and collaborate with relevant stakeholders to address compliance gaps.
• Remediation Management: Develop actionable remediation plans, coordinate corrective actions with system owners, and monitor progress to ensure identified deficiencies are resolved.
• Third-Party Audit Support: Facilitate external compliance assessments by coordinating evidence requests, explaining technical controls to auditors, and minimizing operational disruption throughout the audit process.
• Process Optimization: Identify opportunities to streamline compliance activities, improve audit readiness, and enhance operational efficiency through automation and effective use of GRC tools.
• Cross-Functional Collaboration: Partner with security, engineering, infrastructure, and business teams to strengthen security practices and maintain alignment with industry standards and organizational requirements.

• Professional Experience: 2–6 years of relevant experience in information security, security compliance, IT auditing, risk management, or a related field.
• Security Compliance Frameworks: Practical experience assessing security controls against recognized industry standards, particularly SOC 2, ISO 27001, and PCI DSS.
• Technical Security Knowledge: Strong understanding of technical security controls, including Identity and Access Management, Change Management, Vulnerability Management, Logging, and Monitoring.
• Control Testing and Auditing: Experience evaluating control design and operational effectiveness, reviewing technical evidence, identifying gaps, and supporting internal or external audits.
• Risk Assessment: Ability to identify security risks, assess control deficiencies, document exceptions, and recommend appropriate remediation measures.
• GRC Platforms: Familiarity with governance, risk, and compliance tools for managing audit evidence, tracking exceptions, documenting findings, and monitoring remediation activities.
• Cloud and Infrastructure Knowledge: Exposure to cloud infrastructure, containerized environments, or distributed systems is considered an advantage.
• Audit and Security Certifications: Certifications such as CISA, CRISC, Security+, CISM, or ISO 27001 Lead Auditor are advantageous but not mandatory.
• Analytical Skills: Excellent analytical, critical-thinking, and problem-solving abilities, with strong attention to detail and the ability to investigate complex technical and compliance issues.
• Communication Skills: Strong written and verbal communication skills, including the ability to explain technical security controls and compliance requirements to both technical and non-technical stakeholders.
• Collaboration: Ability to work effectively with cross-functional teams, coordinate multiple audit activities, and build productive relationships with system owners and business stakeholders.
• Adaptability: A proactive and organized approach to managing competing priorities, meeting deadlines, and contributing to continuous improvements in a dynamic technology environment.

• Fully remote working arrangement in India, with flexibility to work from home, an office, or a combination depending on role requirements.
• Flexible working approach designed to support employee productivity and individual working preferences.
• Comprehensive benefits supporting physical health, mental well-being, financial security, and personal needs.
• Opportunities to work with cutting-edge web security, cloud, and edge computing technologies.
• Exposure to internationally recognized security and compliance frameworks, including SOC 2, ISO 27001, FedRAMP, and PCI DSS.
• Collaboration with experienced global security, engineering, and compliance professionals.
• Opportunities to strengthen expertise in information security, risk management, auditing, and GRC operations.
• Professional development and continuous learning opportunities within a global technology environment.
• The opportunity to contribute to security initiatives protecting large-scale digital infrastructure and services used worldwide.