ITGC Compliance Specialist - Internal Controls Management

ITGC Compliance Specialist – Internal Controls Management

Location: East Coast (Remote)

Duration: Long term Contract

Experience:

• experience in IT compliance, ITGC testing, IT audit, GRC operations, or risk and controls.
• Demonstrated experience executing control testing procedures and documenting audit-ready evidence.
• Exposure to SOX ITGC requirements or experience supporting organizations in public-company or IPO-readiness environments.
• Working familiarity with the NIST Cybersecurity Framework (CSF 2.0), including the six core functions and subcategory structure.

Technical & Framework Knowledge:

• Foundational understanding of COSO, SOX, and PCAOB audit expectations, with awareness of IPE validation requirements.
• Familiarity with NIST CSF 2.0 target profiles, implementation tiers, and the crosswalk to complementary frameworks (e.g., ISO 27001, CIS Controls).
• Working knowledge of SaaS governance concepts and SOC report analysis, including CUECs and bridge letters.
• Comfortable operating in DevOps and Agile environments, with basic understanding of CI/CD pipelines, version control (e.g., GitHub), and ticketing systems (e.g., Jira).
• Exposure to identity providers (e.g., Okta, Azure AD) and cloud platforms (e.g., AWS, GCP) is a plus.

Soft Skills:

• Professional assertiveness: Comfortable raising control concerns and holding firm on compliance expectations in a constructive manner.
• Clear communicator: Able to explain control requirements to technical teams and articulate technical architectures to auditors with equal confidence.
• Pragmatic and solutions-oriented: Focuses on workable outcomes and sustainable fixes rather than theoretical perfection.
• Detail-oriented: Produces thorough, well-organized documentation and evidence packages that meet audit-grade standards.

Preferred Qualifications:

• Experience with GRC platforms such as AuditBoard, Drata, OneTrust, ServiceNow GRC, or similar.
• Experience supporting multiple compliance frameworks simultaneously (e.g., SOC 2, ISO 27001, PCI DSS).
• Familiarity with vulnerability management programs and remediation tracking.
• Experience with TPRM processes and vendor risk assessment workflows.