Senior Manager ISO/SOC 2

RS Assurance & Advisory

About The Position

The SOC 2 Senior Manager builds on the Manager role by shifting from managing individual engagements to managing a portfolio of engagements and the people who run them. This role is recognized as a subject matter expert in SOC 2 attestation, with deep command of how SOC 2 engagements are scoped, tested, and reported, and the ability to map multiple compliance frameworks (e.g., ISO 27001, HITRUST, NIST CSF, PCI DSS, HIPAA) to the SOC 2 Trust Services Criteria to support integrated or multi-framework engagements. The Senior Manager carries a personal revenue responsibility, is expected to build a recognized personal brand in the marketplace, and represents RSAA externally through conferences, networking, and community engagement, while continuing to own the firm's highest-complexity client relationships. This is a role for someone who stays with a deal, a client issue, or a difficult engagement until it's actually resolved — not just until the easy part is done.

Requirements

Bachelor's degree in Accounting, Information Systems, or related field
Active CPA license required
3–5 years of experience as a Manager, with a demonstrated history of performance ratings that exceed expectations
7–10+ years of overall experience in SOC 2 or IT audit, including experience managing other Managers or leading a portfolio of engagements
Recognized subject matter expert in SOC 2 attestation, with demonstrated ability to map and reconcile multiple compliance frameworks (e.g., ISO 27001, HITRUST, NIST CSF, PCI DSS, HIPAA) to the SOC 2 Trust Services Criteria
Demonstrated track record of business development and client relationship growth
Strong working knowledge of AICPA Trust Services Criteria and SSAE 18 / AT-C 105 and 205
Established or demonstrable ability to build a professional network and represent a firm publicly
Comfortable operating with incomplete information and shifting priorities, and known for following through on commitments even when the work gets difficult

Nice To Haves

CISA or equivalent certification preferred

Responsibilities

Serve as the firm's go-to expert on SOC 2 engagement mechanics — scoping, Trust Services Criteria selection, testing strategy, and report construction — for complex or unusual engagement scenarios
Map and reconcile multiple compliance frameworks (e.g., ISO 27001, HITRUST, NIST CSF, PCI DSS, HIPAA) to the SOC 2 Trust Services Criteria to support clients pursuing integrated or multi-framework audits
Advise Managers and clients on framework overlap and gap analysis, identifying where existing control evidence can be leveraged across frameworks to reduce duplicative testing
Stay current on AICPA guidance, emerging frameworks, and industry trends, and translate that knowledge into practical guidance for the team and clients
Oversee a book of engagements led by multiple Managers, reviewing at a portfolio level rather than performing first-level workpaper review
Personally own the firm's most complex, highest-risk, or highest-profile SOC 2 engagements (e.g., multi-framework audits, first-year Type II conversions, clients with prior qualified opinions)
Resolve engagement escalations that Managers cannot close independently, including fee disputes, scope disagreements, and exception negotiations
Directly manage and develop SOC 2 Managers, including performance reviews, promotion recommendations, and compensation input
Own staffing and capacity planning across an assigned segment of the practice
Support hiring, interviewing, and training decisions across all levels of the SOC advisory team
Meet or exceed a minimum annual sales goal of $500,000 in new and/or expanded client business
Routinely upsell new products and services into the existing client base (e.g., ISO 27001, HITRUST, penetration testing, additional trust services criteria, readiness assessments)
Originate new business through referrals, proposals, and direct client outreach — not solely supporting partner-led pursuits
Stay engaged through long sales cycles and setbacks, revising the approach as needed rather than letting a stalled pursuit go cold
Own pricing strategy and competitive positioning for proposals within area of responsibility
Develop and maintain a personal brand in the marketplace as a recognized SOC 2 / IT audit expert (e.g., thought leadership, speaking engagements, published content, professional social presence)
Attend industry conferences and represent RSAA, including as a speaker or panelist where opportunities arise
Regularly attend local business and industry events to network and represent RSAA in the community
Serve as a visible ambassador for the firm's SOC advisory practice within professional associations and referral networks
Contribute to firm-wide SOC 2 methodology, training curriculum, and quality control standards
Represent the practice in internal or external quality/peer review matters as needed