Compliance and Audit Manager Job Description
Position Description
Reporting to the Chief Information Security Officer, the Compliance and Audit Manager is an important member of the information security team responsible for risk management and compliance initiatives. This individual must be able to effectively lead multiple projects simultaneously and manage critical relationships with key stakeholders, vendors, and external auditors spread across the world.
The Compliance and Audit Manager will coordinate and lead important security assessments and compliance audits as well as design, implement and help reinforce information security policies and procedures. The Compliance and Audit Manager will be involved in other information security efforts as the business requires.
Responsibilities
- Program manage compliance and audit initiatives, including ISO 27001, ISO 9001, and SOC2.
- Work with external auditors and internal stakeholders to achieve compliance within agreed timeframes.
- Evaluate the effectiveness of and propose improvements to controls and documentation.
- Develop and update information security policies and procedures and assist with the exceptions process.
- Conduct information security risk assessments and compliance reviews of third-party vendors.
- Assist in providing responses to customer security questionnaires.
- Help drive improvements in security awareness.
- Work to constantly improve our compliance status and overall security posture.
- Perform other responsibilities as assigned.
Required Skills and Qualifications
- 3+ years direct experience leading security compliance audits and initiatives with emphasis on ISO 27001, SOC2, and ISO 9001. Should have been involved in seeing at least one program initiative through from start to finish.
- 5+ years of in-depth experience in one or more information security domains preferred.
- Bachelor’s degree in Computer Science or Information Security or equivalent experience.
- Current Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP) preferred.
- Understanding of risk management and business continuity planning.
- At least basic understanding of compliance in Cloud-based and software development environments.
- Self-starter who is able to successfully lead complex compliance programs and deliver on tight deadlines.
- Excellent written/verbal communication and interpersonal skills.
- An outstanding record of security project management success, including establishing schedules, tracking progress, and mitigating risk.
- Ability to work independently with minimal oversight.