Responsibilities
- Develop and manage the compliance and security workstream plan, detailing key milestones, deliverables, responsible parties, dependencies, risks, assumptions, and acceptance standards.
- Organize and oversee audit-readiness initiatives for SOC 2, ISO/IEC 27001, GDPR, and related frameworks across technical and business teams.
- Manage the compliance task registry by prioritizing, assigning, tracking, and reporting on compliance-related activities.
- Lead evidence preparation efforts, including issuing requests, monitoring collection progress, addressing control gaps, and aligning with control owners.
- Assist in aligning organizational policies, procedures, and operations with applicable compliance and security control requirements.
- Monitor discrepancies between documented processes and actual implementation, particularly where evidence is lacking or insufficient.
- Coordinate remediation plans across key domains such as change, incident, access, vulnerability, asset, logging, monitoring, backup, restore, business continuity, disaster recovery, and security architecture.
- Lead workshops, control assessments, evidence reviews, and stakeholder progress meetings.
- Maintain logs for risks, assumptions, issues, decisions, and evidence, along with executive-level status reports.
- Raise concerns about audit-readiness risks, unassigned responsibilities, access obstacles, missing evidence, and unclear scope.
- Collaborate with related program areas including network modernization, IT service management, tooling, architecture oversight, change governance, and program coordination.
- Support the development of change requests when compliance and security requirements exceed the current program scope.
