Principal, Cybersecurity Compliance Services

Specialized Security Services, Inc. (S3 Security)•Plano, TX

About The Position

The Principal of Cybersecurity Compliance Services serves as a senior leader, subject matter expert, and trusted advisor within the Compliance Services practice. This role is responsible for managing and mentoring a team of assessors while also leading and performing client-facing assessment activities across a broad range of cybersecurity, privacy, and compliance frameworks. The Principal provides technical, operational, and strategic leadership for complex engagements involving PCI DSS, SOC 1, SOC 2, ISO 27001, NIST, CMMC, HIPAA, privacy frameworks, risk assessments, and other cybersecurity compliance initiatives. This role is accountable for the quality, consistency, and successful delivery of client engagements, while ensuring the continued development of assessment staff, advancement of service offerings, and achievement of organizational objectives. The ideal candidate combines deep technical cybersecurity expertise, extensive audit and assurance experience, proven people leadership capabilities, strong business acumen, and the ability to build trusted relationships with clients, internal stakeholders, and industry peers. This individual serves as both a hands-on assessor and organizational leader, helping drive excellence in service delivery, team development, client satisfaction, and practice growth. PCI QSA, CPA, CISSP, CISA, CISM, CMMC CCA, ISO 27001 Lead Auditor, or similar advanced credentials are necessary for this role. Successful Principals are recognized as trusted advisors by both clients and internal teams. They balance hands-on assessment work with leadership responsibilities, consistently deliver high-quality client engagements, develop the next generation of assessors, and contribute to the continued growth and reputation of S3 Security.

Requirements

Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Accounting, or a related field, or equivalent professional experience.
Possession of at least two industry-recognized certifications, including combinations of: (ISC)² CISSP, ISACA CISA, ISACA CISM, GIAC certifications, ISO 27001 Lead Auditor/Lead Implementer, or equivalent credentials.
Minimum of ten (10) years of experience in information security, cybersecurity compliance, governance, risk management, auditing, or regulatory compliance.
Minimum of five (5) years of progressive leadership experience leading teams, mentoring professionals, overseeing service delivery, and managing complex client engagements.
Demonstrated experience leading cybersecurity compliance assessments, audits, attestation engagements, and advisory projects across multiple frameworks and industries.
Strong working knowledge of cybersecurity governance, risk, compliance, audit, privacy, and assurance methodologies.
Proven ability to manage client relationships, facilitate executive-level discussions, and communicate complex technical and compliance concepts to diverse audiences.
Experience reviewing and approving assessment documentation, reports, and client deliverables to ensure consistency, quality, and accuracy.
Demonstrated ability to balance client delivery responsibilities with team leadership, operational oversight, and stakeholder management.
Excellent written, verbal, presentation, interpersonal, and leadership skills.

Nice To Haves

PCI QSA certification, or the ability to obtain and maintain QSA status, is strongly preferred.
Additional certifications such as PCI QSA, CPA, CIA, CRISC, CMMC CCP, CMMC CCA, HITRUST CCSFP, IRCA ISMS Auditor (or higher), or similar industry-recognized credentials.
Experience leading PCI DSS, SOC 1, SOC 2, ISO 27001, NIST, CMMC, HIPAA, privacy, and risk assessment engagements from planning through final report delivery.
Experience evaluating internal controls, business processes, governance frameworks, and enterprise risk management practices in support of audit, attestation, and assurance engagements.
Experience developing assessment methodologies, quality assurance programs, service delivery standards, and compliance best practices.
Experience managing geographically distributed teams and multiple concurrent client engagements.
Demonstrated success mentoring and developing high-performing cybersecurity and compliance professionals.
Experience supporting proposal development, client scoping, solution design, and business development activities.
Proven ability to build trusted relationships with executive stakeholders, clients, regulators, assessors, and industry partners.
Experience identifying opportunities to expand existing client relationships and contribute to practice growth.
Demonstrated ability to drive operational excellence, improve service delivery, and contribute to organizational objectives.

Responsibilities

Lead, mentor, coach, and develop a team of cybersecurity assessors to ensure high-quality client service delivery and professional growth.
Establish performance expectations, provide ongoing feedback, conduct performance evaluations, and support career development planning.
Participate in recruiting, interviewing, hiring, onboarding, and retention efforts.
Manage team utilization, project assignments, workload balancing, and resource planning.
Serve as an escalation point for technical, operational, compliance, and client-related matters.
Monitor engagement delivery, team utilization, project profitability, and resource allocations to support operational objectives
Foster a culture of accountability, collaboration, continuous learning, and exceptional client service.
Support cross-functional initiatives and collaborate with executive leadership to achieve organizational goals.
Lead and perform cybersecurity assessments, audits, gap analyses, readiness assessments, examinations, and formal compliance engagements.
Assess existing controls to determine compliance with PCI DSS, SOC 1, SOC 2, ISO 27001, NIST CSF, NIST 800-53, CMMC, HIPAA, GDPR, CCPA, and other applicable regulatory and industry frameworks.
Conduct comprehensive threat and risk assessments, business impact analyses, and security program evaluations.
Evaluate governance, risk management, internal control, and compliance programs to identify gaps and areas for improvement.
Validate remediation efforts and provide practical recommendations designed to strengthen security and compliance programs.
Lead client interviews, documentation reviews, evidence collection, control testing, and report development activities.
Serve as a trusted advisor to executive leadership, compliance teams, information technology organizations, and security stakeholders.
Deliver executive-level presentations, assessment findings, and strategic recommendations to clients and stakeholders.
Manage key client relationships to ensure engagement success, client satisfaction, and long-term partnership.
Maintain accountability for the quality, consistency, and completeness of assessment methodologies, workpapers, reports, and client deliverables.
Conduct technical and quality assurance reviews of assessment documentation and reports prior to client delivery.
Develop, enhance, and maintain assessment methodologies, templates, tools, and quality management processes.
Establish and promote best practices across compliance and assessment services.
Support the evolution of existing services and development of new cybersecurity, privacy, and compliance offerings.
Research emerging regulatory requirements, cybersecurity threats, compliance frameworks, and industry trends to guide service strategy.
Ensure assessment activities are performed in accordance with company policies, accreditation requirements, and industry expectations.
Support proposal development, statement of work creation, client scoping activities, and pre-sales discussions.
Support achievement of company goals related to client satisfaction, service quality, utilization, revenue growth, and operational efficiency.
Assist in identifying opportunities for expanding services within existing client relationships.
Collaborate with leadership on strategic planning, operational improvements, and business growth initiatives.
Represent the organization through industry events, professional organizations, webinars, conferences, publications, and speaking engagements.
Contribute to the continued enhancement of the organization's reputation as a trusted cybersecurity and compliance advisory firm.
Maintain relevant certifications and technical expertise to support evolving cybersecurity, privacy, and regulatory requirements.
Pursue advanced certifications, industry training, and continuing professional education opportunities.
Share knowledge and industry insights through mentoring, training, and internal thought leadership initiatives.