GRC Consultant – Compliance & Audit Readiness

Own the audit journey for an assigned portfolio of global customers - from gap assessment and readiness through external audit fieldwork, findings resolution and closure.

Assess security controls, cloud environments, organizational policies and operating practices to identify control, evidence and implementation gaps early.

Turn identified gaps into practical, risk-based remediation plans with Engineering, IT, DevOps and leadership teams, balancing audit urgency with operational reality.

Review evidence for relevance, completeness and consistency before submission, and maintain a clear, audit-ready trail of requests, responses and decisions.

Serve as the coordination point between customers and independent auditors - facilitate requests, clarify how controls operate and help teams respond accurately without compromising auditor independence.

Track open evidence requests, dependencies, exceptions and delivery risks; communicate progress clearly and escalate roadblocks before they threaten timelines.

Guide customers across SOC 2 Type I and Type II examinations and ISO/IEC 27001 audits, with exposure to ISO/IEC 27701, HIPAA, GDPR and PCI DSS where relevant.

Work flexibly across EU and US hours to support international customers and audit firms during time-sensitive stages of an engagement.

Improve reusable playbooks, evidence guidance and audit workflows by turning recurring issues into scalable practices for the Central Audits Team.

2-5 years of relevant experience in information security, IT audit, compliance consulting or a closely related customer-facing advisory role; strong candidates with deeper experience are also welcome.

Strong working knowledge of SOC 2 Type I and Type II and ISO/IEC 27001, including control design, evidence expectations, readiness and external audit workflows.

Direct experience participating in, coordinating or supporting third-party security audits and responding to auditor requests or findings.

Comfort with AWS, GCP or Azure, SaaS architectures, identity and access management, and the technical context needed to assess how controls operate.

A practical problem-solver who can distinguish a documentation gap from a control-design or operating-effectiveness gap and drive the right remediation.

Clear written and verbal communication, with the judgment to align technical teams, executives, customers and external auditors around facts, ownership and next steps.

Strong organization and follow-through across multiple parallel engagements, changing priorities and time-sensitive evidence requests.

Willingness to work with flexibility across EU and US working hours.

Nice to have: CISA, CISM, CISSP, ISO/IEC 27001 Lead Auditor or Lead Implementer, or a relevant privacy credential.

Nice to have: experience with a compliance automation platform, cybersecurity consultancy or fast-scaling B2B SaaS company supporting international customers.