ITCompliance Specialist

Experience

• experience in IT compliance, ITtesting, IT audit, GRC operations, or risk and controls.
• Demonstrated experience executing control testing procedures and documenting audit-ready evidence.
• Exposure to SOX ITrequirements or experience supporting organizations in public-company or IPO-readiness environments.
• Working familiarity with the NIST Cybersecurity Framework (CSF 2.0), including the six core functions and subcategory structure.

Technical & Framework Knowledge

• Foundational understanding of COSO, SOX, and PCAOB audit expectations, with awareness of IPE validation requirements.
• Familiarity with NIST CSF 2.0 target profiles, implementation tiers, and the crosswalk to complementary frameworks (e.g., ISO 27001, CIS Controls).
• Working knowledge of SaaS governance concepts and SOC report analysis, including CUECs and bridge letters.
• Comfortable operating in DevOps and Agile environments, with basic understanding of CI/CD pipelines, version control (e.g., GitHub), and ticketing systems (e.g., Jira).
• Exposure to identity providers (e.g., Okta, Azure AD) and cloud platforms (e.g., AWS, Google Cloud Platform) is a plus.

Soft Skills

• Professional assertiveness: Comfortable raising control concerns and holding firm on compliance expectations in a constructive manner.
• Clear communicator: Able to explain control requirements to technical teams and articulate technical architectures to auditors with equal confidence.
• Pragmatic and solutions-oriented: Focuses on workable outcomes and sustainable fixes rather than theoretical perfection.
• Detail-oriented: Produces thorough, well-organized documentation and evidence packages that meet audit-grade standards.

Preferred Qualifications

• Experience with GRC platforms such as AuditBoard, Drata, OneTrust, ServiceNow GRC, or similar.
• Experience supporting multiple compliance frameworks simultaneously (e.g., SOC 2, ISO 27001, PCI DSS).
• Familiarity with vulnerability management programs and remediation tracking.
• Experience with TPRM processes and vendor risk assessment workflows.

Preferred Certifications

• CISA (Certified Information Systems Auditor) — Strongly preferred
• CompTIA Security+ or CySA+
• CRISC, CCSK, or similar GRC/security certifications are a plus

NIST CSF or similar framework-specific training or credentials are valued