Security Compliance Specialist

Harris Computer•Remote - Georgia, NV

2d•$80,000 - $90,000

About The Position

The Security Compliance Specialist advises business units on security requirements for certifications, attestations, assessments, and regulatory scopes, including SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, and applicable Nacha requirements. The role reviews security policies, procedures, and other documentation for completeness and alignment, identifies security gaps that may need remediation before external audits, and promotes early, continuous evidence collection. The specialist provides guidance on documentation practices, shared-services and third-party audit scoping, security controls, and technical configurations such as password settings and patching cadence. The role reviews penetration-test scope and results for audit suitability and coordinates with internal audit teams, external auditors, business units, and corporate support functions to plan audits, collect evidence, and track security findings through remediation and closure. Key deliverables include security gap analysis reports, audit-readiness control recommendations, guidance on common auditor evidence requests, shared-services scoping recommendations, and coordination notes or reports supporting evidence-collection timelines.

Requirements

Three or more years of relevant experience assessing security and compliance requirements, including hands-on evaluation of technical security controls and support for audits, assessments, or certification-readiness activities.
Experience advising on security controls required for SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, and Nacha requirements.
Familiarity with common audit evidence requirements, such as patching reports, password settings, and penetration-test results.
Understanding of inclusive versus carve-out scoping considerations for shared services or third-party relationships from a security perspective.
Experience coordinating with internal audit teams, external auditors, and corporate support functions during audit, assessment, and certification processes.
Understanding of documentation standards for internal audits, business continuity, disaster recovery, and penetration-testing activities.
Experience evaluating the design, implementation, and operating effectiveness of administrative and technical security controls and clearly documenting identified gaps.
Bachelor's degree in Information Security, Computer Science, or a related field, or equivalent work experience in place of the degree.
Attention to detail.
Analytical thinking.
Communication proficiency.
Advisory and consultative skills.
Collaboration skills.
Project coordination skills.

Nice To Haves

CISSP (Certified Information Systems Security Professional).
ISO 27001 Lead Implementer certification.
CISA (Certified Information Systems Auditor).
PCIP (Payment Card Industry Professional) certification.
Willingness and ability to obtain PCI ISA (Internal Security Assessor) after hire if PCI DSS responsibilities are assigned.

Responsibilities

Advise business units on security requirements applicable to their certification, attestation, assessment, or regulatory scope.
Review security documentation, policies, and procedures for completeness and alignment with applicable requirements.
Identify security-related gaps that may require remediation before an external audit.
Advise on proactive and continuous evidence collection.
Review documentation practices for internal audits, business continuity, disaster recovery, and external penetration tests to ensure they support audit evidence and scrutiny.
Provide security-focused guidance on whether shared services and corporate support functions should be treated as inclusive or carve-out within audit scope.
Recommend early involvement of shared services providers when evidence requests may require their reports or documentation.
Recommend security controls and improvements needed to satisfy applicable frameworks.
Provide guidance on password settings, patching cadence, and other technical configurations commonly requested as audit evidence.
Review penetration-test scope and results to determine whether they provide suitable evidence for audit, assessment, or certification requirements.
Coordinate with business-unit internal audit teams and external auditors throughout audit, assessment, and certification processes.
Participate in audit planning discussions to ensure security controls and evidence are appropriately represented.
Support communication between business units and shared services or corporate support functions to fulfill evidence requests.
Track security-related audit findings through remediation and closure.
Collaborate with IT, HR, Finance, and Legal when their services are in audit scope to support timely delivery of reports and documentation.
Produce security gap analysis reports, control recommendations, evidence guidance, scoping recommendations, and evidence-collection coordination notes or reports.