Security Compliance Specialist

WHAT YOU WILL DO

Security Guidance for Certification Readiness



* Advises business units on security requirements applicable to their certification, attestation, assessment, or regulatory scope (e.g., SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, and applicable Nacha requirements)


* Reviews security documentation, policies, and procedures for completeness and alignment with certification requirements and other applicable security and compliance obligations


* Identifies security-related gaps that may need remediation prior to an external audit


* Advises on proactive evidence collection, since evidence requests often begin broad (e.g., lists of computers or projects) before narrowing to specific items (e.g., a specific workstation or project); encourages early and continuous evidence gathering rather than waiting for detailed requests

Documentation Standards Guidance



* Advises businesses that meetings related to internal audits, business continuity, disaster recovery, and external penetration tests should be well documented with agendas and minutes to support evidence collection during audits and assessments


* Reviews documentation practices to confirm they will hold up to auditor scrutiny from a security perspective

Shared Services & Third-Party Scoping



* Provides security-focused input on how shared services and corporate/administrative support functions (such as centralized IT, HR, finance, or legal services provided by a parent or corporate entity) should be classified within the audit scope—specifically whether the relationship should be treated as inclusive or carve-out


* Advises on scenarios where a business unit relies on a shared services provider for security-relevant reporting it cannot generate independently (e.g., workstation patching reports or password settings), which typically indicates an inclusive scoping approach rather than carve-out


* Recommends involving the shared services provider (e.g., a Corporate IT function) as early as possible in the audit, assessment, or certification process, since certain evidence requests—such as workstation lists, vulnerability scan reports, or patching audit logs—may require lead time to fulfill

Security Control Recommendations



* Recommends security controls and improvements needed to satisfy the requirements of the applicable framework


* Provides guidance on password settings, patching cadence, and other technical security configurations commonly requested as audit evidence


* Reviews penetration test scope and results from a security standpoint to determine whether they provide appropriate evidence for applicable audit, assessment, or certification requirements

Audit Coordination Support



* Works in coordination with the business unit's internal audit team and external auditors throughout the audit, assessment, or certification process


* Participates in audit planning discussions to ensure security evide...