Security Compliance Auditor

We work with clients globally to strengthen their security posture, protect critical information assets, and address evolving cybersecurity challenges. Through our expertise and technology-driven approach, we help organizations build resilient and secure business environments.

About the Role:

Arancia is seeking a Security Compliance Auditor to lead internal audits, framework and compliance gap assessments, and audit readiness assessments for clients across regulated and high-growth industries.

You will assess clients against industry standards and regulatory frameworks, identify where they fall short, and guide them to compliance and audit-ready status. This role focuses on the work that happens before and around an external audit: understanding a client's current compliance posture, defining the target state, helping remediate gaps, and preparing teams and evidence so they can pass their certification or attestation with confidence.

The ideal candidate combines hands-on audit and assessment experience with a strong grounding in risk management and the ability to turn findings into clear, prioritized roadmaps that technical and business stakeholders can act on.

Key Responsibilities:

Audit, Assessment and Readiness

* Lead internal audits, gap assessments, and readiness assessments against industry standards and regulatory frameworks, including SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, and NIST frameworks.
* Assess clients' current compliance posture by reviewing policies, procedures, control design, implementation, and supporting evidence.
* Lead client interviews, process walkthroughs, control testing, and evidence-review sessions.
* Map controls across multiple frameworks to reduce duplicate effort and give clients a unified view of compliance.

Risk Management

* Apply risk management frameworks such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and NIST CSF 2.0 to identify, rate, and prioritize compliance and security risks.
* Help clients build or mature risk registers, risk treatment plans, and risk acceptance processes.
* Communicate risk clearly to both technical teams and executive leadership.

Remediation and Strategic Guidance

* Help clients define strategic goals for becoming compliant, including target scope, timelines, and certification or attestation milestones.
* Develop prioritized remediation roadmaps that link each gap to its risk, owner, effort, and target date.
* Guide clients through remediation, including policy and procedure development, control implementation, and evidence collection.
* Validate remediation and confirm controls are operating as intended before an external audit.

External Audit Preparation and Support

* Prepare clients for external audits and certifications, including scoping, evidence packages, and mock or pre-assessment walkthroughs.
* Support clients during external audits by coordinating evidence requests and responding to auditor questions alongside the client.
* Help clients interpret and respond to external audit findings and regulatory requirements.

Engagement Delivery

* Prepare clear audit documentation, gap reports, findings, risk ratings, and recommendations for clients and stakeholders.
* Manage multiple concurrent engagements, delivering high-quality work on time and within scope.
* Advise clients on strengthening internal controls, governance, risk management, and compliance programs.

Qualifications and Experience:

* Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Accounting, or a related field.
* 3–5 years of experience in IT audit, internal audit, security compliance, or cybersecurity consulting.
* Hands-on experience conducting internal audits, gap assessments, or readiness assessments against at least two of: SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, or NIST frameworks.
* Working knowledge of regulatory and external audit processes, and of what auditors and assessors expect in evidence and documentation.
* Strong understanding of risk management frameworks and methodologies, such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, or ISO 31000.
* Experience translating findings into remediation plans and compliance roadmaps for clients.
* Excellent written and verbal communication skills, with the ability to engage confidently with clients from technical staff to executives.
* Strong analytical and organizational skills, with the ability to manage competing priorities independently.

Working Hours:

8:00 AM – 5:00 PM Eastern Time (ET), Monday to Friday.

Compensation:

Market-competitive compensation based on experience, qualifications, and expertise.