Security Compliance Analyst

Job Description

The Security Compliance Analyst leads the full certification lifecycle for key security frameworks, acting as the primary bridge between technical engineering teams and external auditors.

This role focuses on managing ISO and SOC 2 Type 2 audits end-to-end, translating complex technical environments into audit-ready evidence, and using AI and automation to reduce the compliance burden on engineering teams.

The ideal candidate is a hands‑on compliance practitioner who understands the realities of Saa S products and can clearly articulate technical control requirements to both technical and non‑technical stakeholders.

Responsibilities

• Own and drive the full lifecycle of ISO and SOC 2 Type 2 audits, from initial planning through final reporting.
• Define detailed audit requirements and translate control language into clear, actionable technical requests for engineering teams.
• Request, collect, and organize evidence from technical owners, ensuring completeness, accuracy, and audit readiness.
• Review and validate the integrity and sufficiency of technical evidence, identifying gaps, inconsistencies, or invalid submissions.
• Track remediation activities for identified gaps and follow up with stakeholders to ensure timely closure of issues.
• Serve as the primary liaison with external audit firms, speaking the language of auditors and effectively defending the control environment.
• Create and maintain an annual audit calendar, including timelines, milestones, and preparation activities for audit windows.
• Ensure the organization is well prepared for audits by coordinating pre‑audit reviews, walkthroughs, and readiness assessments.
• Utilize AI and large language models to automate evidence collection, parse system logs, draft control descriptions, and identify potential compliance gaps before audits.
• Apply a human‑in‑the‑loop approach to AI usage by critically reviewing and validating AI‑generated outputs for accuracy and completeness.
• Review technical configuration reports for infrastructure, networking, containers, and databases to determine whether settings align with secure configuration expectations.
• Research and identify appropriate secure configurations and control implementations for technologies not previously encountered.
• Clearly explain to engineers what specific evidence or configurations are required, using precise technical language rather than generic control descriptions.
• Collaborate with engineering and security teams to define and refine technical controls that align with ISO, SOC 2 Type 2, and other relevant frameworks.
• Communicate complex compliance requirements in clear, accessible terms to non‑technical stakeholders across the organization.
• Push back constructively on auditors when appropriate, providing reasoned explanations and evidence to support the existing control environment.
• Contribute to the continuous improvement of compliance processes by identifying opportunities to streamline workflows and reduce manual effort through automation and AI.

Essential Skills

• Proven, specific experience managing end‑to‑end ISO and SOC 2 Type 2 audits, including planning, execution, and final reporting.
• Baseline understanding of ISO and SOC 2 Type 2 frameworks and their associated control requirements.
• Experience running audits, with a preference for technology‑focused auditing experience.
• Demonstrated ability to understand and assess technical controls in cloud and Saa S environments.
• Technical literacy in cloud platforms, with a particular preference for experience with AWS.
• Ability to read and interpret technical configuration reports and determine whether configurations meet secure standards.
• Capability to identify when provided technical evidence is insufficient or invalid and to request appropriate corrective evidence.
• Demonstrated experience using AI and large language models to streamline compliance and audit tasks, including evidence collection and analysis.
• A clear human‑in‑the‑loop philosophy for validating AI output to ensure accuracy and reliability.
• Strong communication skills, including the ability to explain complex compliance requirements to non‑technical stakeholders.
• Ability to understand and articulate detailed technical requests from engineers and translate them into compliance terms.
• Confidence and professionalism in pushing back on auditors when necessary, supported by clear evidence and reasoning.
• Comfort discussing and auditing Saa S infrastructure running on public cloud environments such as AWS, Azure, or GCP and private cloud environments.
• Familiarity with networking concepts and components, including firewalls, switches, routers, VPNs, and secure remote access.
• Exposure to Linux‑based server environments and various database management systems.
• Understanding of containerized environments, including Kubernetes and Docker.
• Ability to research and determine appropriate secure settings and configurations for unfamiliar technologies.
• Additional Skills & Qualifications
• Understanding of the NIST framework, particularly as it applies to security controls and policy design.
• Experience working with security controls that align with NIST‑based policies.
• Creative use of AI to collect, review, and automate evidence handling in a flexible and scalable way.
• CISSP certification, which demonstrates a deep understanding of technical security controls (strongly valued but not required).
• Experience at a CISO or senior security leadership level is beneficial, though practical hands‑on experience is preferred over certifications alone.
• Baseline familiarity with NIST and other security frameworks used to structure security controls and policies.
• Interest in continuously improving audit and compliance processes through automation and innovative tooling.

Work Environment

The role focuses on a Saa S product operating across both public cloud platforms (such as AWS, Azure, and GCP) and private cloud environments.

You will regularly interact with infrastructure components, including firewalls, switches, routers, VPNs, and secure remote access solutions, as well as Linux‑based server environments and various database management systems.

The environment makes extensive use of container technologies like Kubernetes and Docker.

Collaboration with engineering and security teams is central to the role, and you will frequently work with technical configuration reports, system logs, and automated tools.

AI and large language models are an integral part of the workflow, particularly for evidence collection, log parsing, and drafting control documentation.

The position emphasizes a professional, detail‑oriented, and collaborative culture, where clear communication, proactive planning, and continuous improvement of compliance processes are highly valued.

Job Type & Location

This is a Contract position based out of Raleigh, NC.

Pay and Benefits

The pay range for this position is $50.00 - $55.00/hr.

Eligibility requirements apply to some benefits and may depend on your job classification and length of employment.

Benefits are subject to change and may be subject to specific elections, plan, or program terms.

• If eligible, the benefits available for this temporary role may include the following:
• Medical, dental & vision
• Critical Illness, Accident, and Hospital
• 401(k) Retirement Plan – Pre‑tax and Roth post‑tax contributions available
• Life Insurance (Voluntary Life & AD&D for the employee and dependents)
• Short and long‑term disability
• Health Spending Account (HSA)
• Transportation benefits
• Employee Assistance Program
• Time Off/Leave (PTO, Vacation or Sick Leave)
• Workplace Type

This is a hybrid position in Raleigh, NC.

Application Deadline

This position is anticipated to close on Jul 11, 2026.

Equal Employment Opportunity Statement

The company is an equal opportunity employer and will consider all applications without regard to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.

• Mandated Compliance Statements
• San Francisco
• Fair
• Chance

Ordinance: Pursuant to the San Francisco Fair Chance Ordinance, for all positions located in the city and county of San Francisco, we will consider for employment qualified applicants with arrest and conviction records.

• Massachusetts
• Lie

Detector: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment.

An employer who violates this law shall be subject to criminal penalties and civil liability.

Use of Artificial Intelligence (AI): We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates.

AI helps assess applications and qualifications, but final decisions are made by our hiring team.

By applying, you acknowledge and agree that your application may be reviewed using AI tools.

#J-18808-Ljbffr