[8PP] Compliance Specialist

Software Mind Americas

17d

About The Position

We are looking for an experienced Information Security Governance, Risk, and Compliance Specialist to support our security and compliance initiatives. The primary focus of this role will be facilitating the organization’s 2026 SOC 1 and SOC 2 audits, along with supporting policy management, enterprise risk, and vendor risk activities. This role involves working across Security, IT, Operations, Finance, Legal, and Procurement to coordinate external audits, maintain security policies, manage enterprise and vendor risks, and strengthen the organization’s overall compliance program.

Requirements

Experience supporting SOC 1 and SOC 2 audits, including evidence collection, control validation, and auditor coordination.
Experience with information security policies, enterprise risk management, and vendor risk assessments.
Background working in software-driven environments involving cloud applications and SaaS platforms.
Experience with GRC platforms such as Full Circle, UpGuard, Drata, or Vanta.
Strong organizational, communication, and stakeholder-management skills.
Ability to manage multiple priorities independently and handle sensitive information with discretion.
CISSP, CRISC, or CISA certification.

Nice To Haves

Hands-on experience with Full Circle or UpGuard, particularly for risk assessments.
SaaS, cloud security, or compliance certifications.

Responsibilities

Manage the lifecycle of Information Security policies, including reviews, updates, approvals, publication, and version control.
Coordinate urgent policy changes and annual policy review cycles.
Maintain policy records and approval documentation to support governance and audit readiness.
Track outstanding actions and improve policy management workflows, templates, and review processes.
Coordinate the annual SOC 1 and SOC 2 attestation processes and other external audits.
Manage audit timelines, evidence collection, documentation, stakeholder coordination, and auditor requests.
Partner with control owners to validate control performance and address findings, exceptions, and remediation activities.
Maintain audit evidence repositories and support the preparation of control descriptions, management narratives, and responses.
Escalate significant risks, control gaps, and audit blockers to the CISO and relevant leadership.
Support risk intake, assessment, documentation, tracking, and reporting.
Maintain risk registers and workflows within Full Circle, UpGuard, Drata, Vanta, or similar GRC platforms.
Track remediation plans, target dates, control gaps, and overdue actions.
Prepare risk dashboards, metrics, and status reports for leadership.
Improve risk scoring, reporting, workflows, and platform utilization.
Manage third-party risk assessments, due diligence, and ongoing vendor monitoring.
Review vendor security documentation and track remediation activities.
Collaborate with Procurement, Legal, IT, and business teams on onboarding and renewal decisions.
Escalate critical vendor risks, exceptions, and unresolved concerns.