Audit and Compliance Specialist

mid

Legal & ComplianceCompliance Specialist

0 views0 saves0 applied

Apply Now

Quick Summary

Key Responsibilities

· Director, Information Security Dotted line: Lead Audit and Compliance Specialist 5.

Requirements Summary

Possesses extensive experience and deep expertise in the field. Effectively resolves a broad range of challenges using sound judgment, creativity, and practical knowledge.

Technical Tools

Legal & ComplianceCompliance Specialist

The Audit and Compliance Specialist – Governance, Risk & Compliance performs the assurance activities of the Aptean Information Security Office: testing whether security controls are designed adequately and operating effectively, producing the evidence that demonstrates it, and assessing third parties, products and AI systems against Aptean control requirements. The role supports external audits and certification assessments, coordinates technical security assessments, authors security policies, standards and department handbooks, and administers the exception and control registers.

Responsibilities

~1 min read

→Executes control testing against the information security control framework on the defined cycle, including sampling, test procedures and documented conclusions on operating effectiveness.

→Assesses control evidence for sufficiency, records findings with severity, root cause and accountable owner, and validates remediation evidence before closing findings raised by the function.

→Supports external audits, certification assessments and customer-driven assessments through evidence preparation, request tracking, auditor liaison and follow-up submissions.

→Coordinates technical security assessments: defines scope against control, certification and contractual requirements, manages independent assessors, reviews deliverable quality, and registers resulting findings for tracking.

→Conducts pre-engagement and periodic third-party security and privacy due diligence assessments, reviews vendor assurance artefacts and contractual security requirements, and issues documented risk opinions.

→Assesses AI systems against applicable security control requirements, performs AI audit and assurance activity, and provides security input to AI risk categorisation and operator role determination undertaken by the governance function.

→Drafts and maintains security policies, standards and department security handbooks, working with subject matter experts to define applicable controls, expected evidence and accountable owners.

→Administers the exception and risk registers, monitors expiry, produces recurring compliance and control reporting for management and governance committees, and performs other related duties as assigned.

· Director, Information Security

Lead Audit and Compliance Specialist

Nice to Have

~1 min read

☒ ☐ Bachelor’s degree

☐ ☐ Master’s degree

☐ ☐ Ph.D.

☐ ☐ J.D. (law)

☐ ☒ Certification: ISO 27001 Lead Auditor/Lead Implementer, CISA, CCSK

☐ ☐ Registration:

☐ ☐ Licensure:

☐ ☐ Other:

4 years of experience in information security in a dedicated governance, risk and compliance, security compliance or IT audit role.

· Information security control frameworks – SOC1, SOC 2, SOC3, ISO 27001, ISO 42001 and NIST 800-53 or NIST CSF – including control interpretation and evidence requirements.

· Audit and assessment practice, including sampling, evidence sufficiency, finding classification and corrective action tracking.

· Third-party and vendor security risk assessment methodology, contractual security requirements and assurance artefact review.

· Artificial intelligence governance and AI security requirements, including risk-tiering under the EU AI Act, operator role concepts, ISO 42001, and how AI systems are assessed against security controls.

· Security documentation hierarchy – how policy, standards, baselines, procedures and department handbooks relate to one another.

· Cloud security concepts across at least one major provider, sufficient to interpret cloud control requirements and assess supporting evidence.

· Data protection principles and regulatory obligations, including GDPR and privacy assessment processes.

· Writes clearly and precisely in English. A substantial part of the role produces documentation that non-security teams must follow and auditors must rely on; writing ability is assessed during selection.

· Reaches supportable conclusions from incomplete evidence, and states limitations rather than overstating assurance.

· Distinguishes an isolated control failure from a systemic control weakness and escalates accordingly.

· Scopes, commissions and challenges assessments delivered by specialist third parties without performing the technical work.

· Works effectively with technical teams without owning their work – asks precise questions, obtains attributable answers, and escalates where accountability is declined.

· Manages concurrent assurance activities against defined cycles and reports slippage when it occurs rather than at the milestone date.

· Maintains accuracy and traceability in registers, evidence records and reporting.

· Applies professional scepticism and maintains an independent position under commercial or delivery pressure.