Information Security Compliance & Audit Manager

County of Orange•Santa Ana, CA

About The Position

Orange County Information Technology (OCIT) Countywide Services is seeking an experienced manager to oversee audit support, vendor security risk assessments, and Payment Card Industry (PCI) compliance management. The Information Security Compliance & Audit Manager serves as the enterprise owner of OCIT’s centralized audit coordination services and the County’s primary liaison for IT audits, security assessments, external auditors, vendors, and internal stakeholders. The role works across multidisciplinary IT teams and County departments, and calls for strong analytical, comprehension, written, and communication skills. The manager coordinates audit planning and execution, communications, and escalation paths; supports County departments with PCI audit scoping and recurring vulnerability site scans; and evaluates new device purchases. The position presents executive-level audit status reports, trend analysis, and lessons learned to promote continuous improvement. It also facilitates cross-functional reviews and the Countywide Security Review & Approval process for new technologies, cloud services, SaaS platforms, and third-party vendors, ensuring alignment with County security, privacy, and procurement requirements. The role evaluates vendor security and privacy, maintains a centralized vendor risk inventory in the Optro GRC platform, develops and delivers training, and uses project organization practices such as scheduling, milestones, and deliverables to achieve results. The manager makes policy and business decisions using sound judgment and risk management, travels throughout Orange County, attends staff meetings as needed, and performs related duties as assigned. A California Class C Driver License is required. Candidates must successfully complete an extensive background investigation before starting employment.

Requirements

At least three years of work experience performing audit support, IT audits, IT compliance, PCI DSS work, or a combination of these areas is identified as an ideal qualification, not a stated minimum qualification.
California Class C Driver License required.
Successful completion of an extensive background investigation before employment begins.
Ability to analyze, administer, and maintain information security architecture, technologies, tools, appliances, practices, and controls.
Understanding of IT and ability to apply advanced methodologies, principles, and concepts to coordinate major projects.
Understanding of audit coordination, audit readiness, and audit remediation management.
Understanding of PCI DSS 4.0.1 requirements, assessment methodologies, and validation processes.
Ability to use risk management and internal control frameworks applicable to public-sector and regulated environments.
Ability to use project management software to develop schedules, manage deliverables, and monitor workstream progress.
Ability to develop executive reports and visual presentations using presentation platforms.
Ability to evaluate and monitor information security risk strategies for efficiency, accuracy, and compliance.
Familiarity with GRC and service management platforms, evidence repositories, and security tooling outputs.
Understanding of payment technologies, cardholder data environments, and secure system architectures.
Working knowledge of HIPAA, PCI DSS, the CJIS Security Policy, the NIST Cybersecurity Framework, and NIST SP-800 Series.
Ability to collaborate and establish rapport with staff, managers, and people across County departments.
Ability to provide accurate information related to IT audits, IT security compliance, operations, and programs.
Ability to lead training sessions and workshops for non-IT business users.
Ability to build and maintain positive, forward-focused, customer-oriented work environments.
Strong verbal and written communication skills, including presenting training and support information, coordinating with County agencies, and translating technical findings into clear, actionable reports for non-technical stakeholders.

Nice To Haves

At least three years of work experience in audit support, IT audits, IT compliance, PCI DSS, or a combination of these areas.
One of the following certifications: CISA (Certified Information System Auditor), CISSP (Certified Information Systems Security Professional), CRISC (Certified in Risk and Information Systems Control), or PCI ISA (Internal Security Assessor) or equivalent.
Experience with project management software such as Microsoft Project, Jira, or Asana.
Experience with presentation platforms such as Microsoft PowerPoint, Google Slides, Prezi, or Figma.
Experience with GRC or service management platforms such as Optro or ServiceNow, evidence repositories such as SharePoint, and security tooling outputs such as vulnerability management or SIEM.

Responsibilities

Serve as the primary audit liaison and advocate between internal stakeholders and OCIT, building partnerships and supporting effective communication across organizations.
Lead audit planning and execution, communications, and escalation paths.
Coordinate audit requirements with IT teams in a multidisciplinary environment.
Guide County departments on PCI audit scoping, conduct recurring vulnerability site scans, and evaluate new device purchases.
Prepare and present executive-level audit status reporting, trend analysis, and lessons learned to drive continuous improvement.
Coordinate cross-functional reviews involving OCIT Security, OCIT Functional Services teams, OCIT Business Relationship Management, Privacy, Legal, and Procurement.
Ensure new technologies and service providers align with County information security, privacy, and procurement requirements.
Facilitate the Countywide Security Review & Approval process for new technologies, cloud services, SaaS platforms, and third-party vendors.
Conduct security and privacy evaluations of vendor solutions for County security compliance.
Lead development of training materials and facilitate training sessions and workshops.
Maintain a centralized vendor risk inventory in the Optro GRC platform.
Use project organization practices, including scheduling, milestones, and deliverables, to achieve successful outcomes.
Make policy and business decisions using sound judgment and risk management.
Travel throughout Orange County, attend staff meetings as needed, and perform related duties as assigned.