Information Security Assurance Advisor

MRO Corporation•,

2d•$104,000 - $140,000

About The Position

The Information Security Assurance Advisor develops, implements, and maintains information security policies, procedures, controls, and evidence; leads audit readiness and execution for HITRUST and SOC 2 Type II examinations; administers audit activities through the Vanta GRC platform; drives compliance; and helps maintain a security-focused culture across MRO.

Requirements

Demonstrated hands-on experience managing at least one complete HITRUST readiness and validated assessment cycle, including scoping, requirement interpretation, evidence validation, assessor coordination, gap remediation, and certification support.
Demonstrated hands-on experience managing at least one complete SOC 2 Type II examination cycle, including control mapping to the AICPA Trust Services Criteria, observation-period evidence, control-owner coordination, sample requests, auditor inquiries, exceptions, complementary user entity controls, subservice organization considerations, remediation, and report review.
Demonstrated practical experience using Vanta to execute audits—not solely view dashboards—including framework and control administration, ownership assignments, system integrations and automated tests, policy and document management, evidence mapping and review, auditor collaboration, issue tracking, remediation workflows, and audit-readiness reporting.
6+ years of information security assurance, GRC, compliance, or audit experience, including direct responsibility for coordinating HITRUST and SOC 2 Type II audits and using Vanta to manage controls, evidence, auditor requests, findings, and remediation.

Nice To Haves

Knowledge or work experience with HIPAA, PCI DSS, TX-RAMP, NIST Cybersecurity Framework, and cross-framework control mapping.
Flexibility and ability to shift to operational hands-on activities as needed
Conform to shifting priorities, demands and timelines through analytical and problem-solving capabilities
Client management experience
Speed and quality of deliverable is the key
Excellent communication and presentation skills

Responsibilities

Apply applicable regulations, standards, and industry practices—including HITRUST CSF, AICPA Trust Services Criteria for SOC 2 Type II, HIPAA, TX-RAMP, PCI DSS, and NIST frameworks—to manage risk, maintain audit readiness, and support compliance.
Perform process definition/update and deployment across all teams in consultation with the respective functions.
Identify best practices, drive continuous information security related process improvement and facilitate deployment of information security process changes
Document the identified Information Security Policies and processes to ensure compliance with legal, regulatory and security standards (e.g. HITRUST, SOC-2, HIPAA, TX-RAMP, PCI-DSS, etc.) and maintain the Information Security Management Systems.
Perform due diligence for third party contracts and perform periodic 3rd party Risk Assessments.
Drive and complete Information Security Assessments assigned to MRO by its clients.
Manage and support Information Security Risk Management Lifecycle across MRO.
Ensure appropriate treatment of risk, compliance, and assurance from internal and external perspective.
Own and drive the Information Security Incident Management Program at MRO.
Lead and coordinate HITRUST readiness and validated assessments and SOC 2 Type II examinations from planning through report issuance, including scope definition, control-owner coordination, evidence collection and quality review, walkthroughs, sampling support, auditor requests, exception management, remediation tracking, and leadership status reporting.
Use Vanta as the primary GRC and audit management platform to configure frameworks and controls, assign control owners, manage policies and documents, monitor automated tests and integrations, collect and map evidence, manage auditor access and requests, track findings, and drive timely remediation through audit completion.
Maintain a continuously audit-ready control environment by monitoring evidence status, testing results, control performance, open gaps, and remediation commitments across HITRUST and SOC 2 requirements.
Drive the phishing simulation program at MRO and focus on its continual improvement.
Drive Business Impact Analysis, Privacy Impact Analysis across MRO to determine and update applicable RTOs and RPOs.
Design and participate in Business Continuity & Disaster Recovery efforts across MRO.
Maintain and update security training material and conduct training programs to coach and guide the teams in deploying the policies and processes
Supporting departments in collecting security specific metrics, conducting analysis and identifying actions for process improvement
Prepare and circulate weekly, monthly and quarterly reports for the Infosec team and present it to Infosec leadership team.
Ensure procedures and playbooks for all sub teams within Infosec team is always up to date.