Information Security Consultant - System and Organization Controls (SOC 1 / SOC 2) Compliance

Tevora is seeking an Information Security Analyst to join the SOC Compliance team.This role on the SOC Compliance team is looking for a passionate individual who has a solid balance between business acumen and technical expertise. Comfortable across various disciplines of information security, this consultant will be responsible for assessing System and Organization Controls (SOC) compliance, for SOC 1 and SOC 2, on a wide variety of client projects for some of the world's largest organizations. Other compliance frameworks this role will work on may include ISO 27001 and PCI, as well as GRC support for clients. This role will also provide mentorship to junior team members and participation in ongoing training opportunities. The successful candidate for this role will be detail-oriented, have a solution-focused attitude, and possess strong written and verbal communication skills.

ABOUT THE JOB

A day in the life could include:Participating in and leading IT and Compliance assessments, audits, gap analyses, and remediation.Leading and actively contributing to projects in the areas of System and Organization Controls (SOC 1 & SOC 2) Compliance assessments.Communicating with project stakeholders to effectively convey the requirements of technical and process improvements.Supporting various information security compliance projects, such as PCI or ISO gap assessments.Assisting in the development of customized policies, procedures, controls, disaster recovery plans and other documentation for applications, systems, and infrastructure for our clients.Managing policy exceptions, including working directly with the teams to document exceptions, and identifying compensating controls and remediation action plans.Take on additional responsibilities as needed or as new opportunities arise. Proactively support the team with tasks and projects that emerge over time.Completed minimum 2 years of experience in information security, information technology, business consulting, enterprise risk, or compliance field.Hold at least one Auditing, Risk, or IT certification from the following list: CISSP, CISA, CISM, CRISC, ISO Lead Auditor or Military equivelant.Possess knowledge of common IT and security concepts such as firewall management, server management, access control, and authentication. Ability to connect easily with clients and colleagues to communicate effectively across business and technical boundaries- to offer recommendations as an expert with best practices.Ability to work independently without detailed guidance.Proficient in writing reports and technical documentation.Proficient in MS Office tools and basic professional acumen.

RESPONSIBILITIES✨

• Participating in and leading IT and Compliance assessments, audits, gap analyses, and remediation.
• Leading and actively contributing to projects in the areas of System and Organization Controls (SOC 1 & SOC 2) Compliance assessments.
• Communicating with project stakeholders to effectively convey the requirements of technical and process improvements.
• Supporting various information security compliance projects, such as PCI or ISO gap assessments.
• Assisting in the development of customized policies, procedures, controls, disaster recovery plans and other documentation for applications, systems, and infrastructure for our clients.
• Managing policy exceptions, including working directly with the teams to document exceptions, and identifying compensating controls and remediation action plans.

QUALIFICATIONS✨

• Completed minimum 2 years of experience in information security, information technology, business consulting, enterprise risk, or compliance field.
• Hold at least one Auditing, Risk, or IT certification from the following list: CISSP, CISA, CISM, CRISC, ISO Lead Auditor or Military equivalent.
• Possess knowledge of common IT and security concepts such as firewall management, server management, access control, and authentication.
• Ability to work independently without detailed guidance.
• Proficient in writing reports and technical documentation.
• Proficient in MS Office tools and basic professional acumen.

ADDITIONAL ELIGIBILITY

Hold a bachelor’s degree from an accredited 4-year university. Demonstrated experience in at least one other information security compliance assessment (ISO 27001, PCI Level 1, HITRUST) or military equivalent. Prior or current CPA license, Commitment to continued learning

BENEFITS✨

• Provide mentorship to junior team members
• Participation in ongoing training opportunities

OTHER

Two physical locations, one in Irvine, California, and another in Fairfax, Virginia. Discuss with the recruiter.