Data Centre Compliance Auditor

Bridewell•Florida City, FL

1d•Hybrid

About The Position

Bridewell is a leading cyber security services company specializing in protecting and transforming critical business functions for some of the world's most trusted organizations. We are the trusted partner for operators of essential services and provide end-to-end cyber security capabilities that help our clients overcome their security challenges, allowing them to operate safely and securely. Having expanded into North America in 2022, Bridewell is quickly increasing its presence across the United States, showing our commitment to becoming a major player in the US cyber security market. Our US operations are focused on delivering cyber security solutions in the critical infrastructure sector, providing critical support to organisations navigating security challenges. We are looking for a Data Center Compliance Auditor to support the delivery of Bridewell services to one of our most strategic clients. You will support our client's Security & Compliance team across critical business operations, compliance and data protection activities within its infrastructure data centers. The role will focus on ensuring that data center environments remain audit-ready, while supporting additional audit and compliance requirements as they arise. You will work closely with a broad range of cross-functional stakeholders, including facilities, engineering, physical security and infrastructure finance teams.

Requirements

5+ years of experience in IT audit, compliance or information security, with demonstrable experience across SOC 2, ISO 27001, SOX and/or PCI.
Proven experience managing compliance programmes within a Three Lines of Defense (3LOD) governance framework.
Experience with the AICPA Trust Services Criteria and SOC 2 reporting framework, including Type I and Type II.
Strong understanding of control design through to control testing, including evaluating both design and operating effectiveness.
Demonstrable ability to interpret evidence and assess whether it satisfies control objectives and auditor expectations.
Experience planning and executing compliance audits in data center or critical infrastructure environments.
Familiarity with physical and environmental security controls, logical access controls and change management processes.
Strong stakeholder management skills, with the ability to build relationships and influence cross-functional teams at all levels.
Applicants must be authorized to work in the United States.

Nice To Haves

Professional certification such as CISA, ISO 27001 Lead Auditor, CISSP or CRISC.

Responsibilities

Plan, coordinate and facilitate external audits, both remote and on-site, across the client's owned and leased data center portfolio.
Support audits covering SOX, SOC 2, ISO 27001, PCI and other emerging audit requirements.
Manage audit schedules, scope definition and logistics with external auditors.
Act as a primary liaison between external auditors and internal cross-functional teams throughout audit engagements.
Own end-to-end evidence gathering across facilities, engineering, physical security and infrastructure finance teams to satisfy auditor requests for information (RFIs).
Respond to auditor inquiries with accurate, timely and well-documented evidence.
Maintain organized evidence repositories and ensure completeness of audit documentation.
Interpret evidence requirements and guide control owners on the standard of evidence expected.
Attend and support on-site security walkthroughs with external auditors at data center facilities.
Conduct virtual and on-site walkthroughs of data center security environments in support of SOC 2, ISO 27001 and SOX assessments.
Prepare site teams for auditor walkthroughs through pre-audit briefings and rehearsals.
Document walkthrough findings and coordinate any required follow-up actions.
Conduct control testing covering design effectiveness and advisory activities across physical and environmental security, logical access, change management and availability controls.
Evaluate control design within a Three Lines of Defense (3LOD) framework and provide advisory input on control adequacy.
Conduct mock audits and tabletop exercises to prepare sites for external assessments.
Develop and deliver compliance training to data center teams on control requirements and audit expectations.
Support compliance impact assessments for new processes, system changes and site launches.
Advise cross-functional teams on the compliance implications of operational changes.
Maintain documentation of control descriptions, policies and procedures relevant to audit scope.