About the role
Role summaryRun the client's SOC 2 compliance program day to day: one SOC 2 Type 2 report (12 month period, July to June), one SOC 2 Type 1 report, and a readiness assessment for a new mobile application. Coordinate client staff, a managed security provider, ThoughtFocus teams and cloud providers, and act as the day to day contact for the external auditor. Client leadership owns and approves controls.
ResponsibilitiesOwn the audit evidence calendar and manage auditor requests and follow ups.Draft annual system description updates for client approval.Run quarterly user access reviews and compile the quarterly security systems report.Review the managed security provider's quarterly reports and track training completion.Coordinate access requests, removals and vendor resource onboarding and offboarding.Review subservice provider SOC reports and send vendor security questionnaires.Track remediation of vulnerability scan and penetration test findings.Coordinate incident response under client policy.Facilitate the annual risk assessment and keep security policies current.Respond to carrier security questionnaires, within 24 hours where required.Complete knowledge transfer from the outgoing incumbent in the first 30 days.
Outside this roleApproving controls or risk, signing audit letters, hands on administration of identity, devices or firewalls, and people management.
Requirements12-15+ years in information security and GRC.At least two full SOC 2 Type 2 cycles run from the service organization side.Working knowledge of Microsoft Entra ID, Intune, Azure and Microsoft 365.Experience with access reviews, vendor risk and customer security questionnaires.Clear written English for US executives and auditors.Preferred: insurance or financial services, Salesforce security basics, CISA, CISM, CRISC or CISSP, valid US business visa.
Working modelDaily overlap with US Eastern business hours. One onsite trip a year to the Atlanta area during the audit.