Compliance Administrator

Ampacity, LLC.•, IA

1d•$70,000 - $80,000•Remote

About The Position

The Compliance Administrator at Ampacity keeps the company audit-ready year-round. The role owns day-to-day work related to SOC reporting, PII and data privacy controls, NetSuite access governance, and IT general controls (ITGC), including collecting evidence, tracking requests, and ensuring controls operate as documented. This is a 100% remote role, and the responsibilities may evolve over time with the needs of the business.

Requirements

At least 2 years of experience in compliance, internal audit, IT audit, or risk, with a bachelor's degree in Accounting, Information Systems, or a related field, or equivalent experience.
Working knowledge of SOC 1/SOC 2, ITGC domains (access, change management, and operations), and PII and data privacy basics.
Hands-on experience with roles, permissions, and user administration in NetSuite or a comparable ERP.
Ability to manage multiple requests and deadlines and comfort working in Excel and tracking tools.
Clear writing skills and ability to request evidence from non-technical teams without friction.

Responsibilities

Coordinate SOC audit readiness and the annual audit cycle with control owners and external auditors.
Maintain the control matrix, narratives, and system descriptions as processes and systems change.
Monitor control testing, log exceptions, and track remediation to closure.
Collect and review vendor SOC reports, documenting CUECs and exceptions.
Maintain the inventory of systems that store or process PII.
Support data classification, retention, and disposal in line with policy and regulations.
Track privacy requests, incidents, and corrective actions through resolution.
Run periodic access reviews of NetSuite and PII-bearing systems, collect manager sign-offs, and document results.
Monitor segregation-of-duties conflicts, stale or excessive access, and privileged accounts, and drive them to resolution.
Verify that joiner, mover, and leaver changes are approved and completed on time.
Create, assign, and track auditor and ITGC requests (PBC) across access, change management, backup and recovery, and IT operations.
Gather evidence, including screenshots, reports, tickets, approvals, and populations, and check it for completeness, accuracy, and date range before submission.
Confirm that role and permission changes have proper approval and documentation.
Maintain the central repository of policies, procedures, and audit artifacts, and update them regularly.
Report the status of open requests, exceptions, and remediation to leadership.
Maintain the compliance calendar for recurring activities such as quarterly access reviews and annual policy reviews.