Lead - Compliance

Job Title: Compliance Specialist

Experience: 5–8 years

Role Overview

The Compliance Specialist is responsible for supporting and managing the organization’s information security, privacy, and regulatory compliance activities. The role focuses on maintaining management system documentation, coordinating audits and assessments, tracking corrective actions, and helping ensure alignment with applicable standards and regulatory requirements.

Key Responsibilities

ISMS & Governance

• Maintain and continually improve the Information Security Management System (ISMS), including policies, procedures, controls, and records
• Coordinate risk assessments, risk treatment plans, Statement of Applicability (SoA), and management review activities
• Maintain compliance registers, control matrices, evidence repositories, and documented information
• Support security awareness initiatives and communicate compliance requirements to relevant stakeholders
  
  

• Support implementation, maintenance, and continual improvement of ISO/IEC 27001-based ISMS requirements
• Demonstrate working knowledge of ISO/IEC 42001 requirements for an Artificial Intelligence Management System (AIMS), including AI governance and risk management
• Coordinate compliance activities for PCI DSS and SOC 2, including control mapping, evidence collection, gap assessments, and remediation tracking
• Interpret applicable contractual, regulatory, and customer security requirements and map them to internal controls
  
  

• Coordinate internal audits, external certification audits, surveillance audits, and customer assessments
• Prepare audit plans, evidence packs, control narratives, and supporting documentation
• Track nonconformities, observations, risks, and corrective and preventive actions through closure
• Work with control owners to validate evidence, address audit findings, and demonstrate control effectiveness
  
  

• Identify compliance gaps and assess risks related to information security, privacy, AI governance, and applicable standards
• Maintain risk registers, corrective action plans, compliance calendars, and periodic review records
• Monitor changes to standards and regulatory requirements and assess their impact on organizational controls
• Recommend practical improvements to strengthen governance, documentation, and control maturity
  
  

• Collaborate with IT, security, HR, legal, engineering, and business teams to implement and evidence controls
• Prepare compliance status reports, audit updates, risk summaries, and management review inputs
• Act as a coordination point for auditors, customers, and internal stakeholders on compliance-related matters
  
  

• 5–8 years of experience in information security compliance, GRC, audit, risk management, or a related role
• Practical experience with ISMS and strong working knowledge of ISO/IEC 27001; knowledge or experience with ISO/IEC 42001, PCI DSS, and SOC 2 is required
• Experience in audit coordination, evidence preparation, gap assessments, control mapping, and remediation tracking
  
  

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field
• Relevant certifications such as ISO/IEC 27001 Lead Implementer/Lead Auditor, ISO/IEC 42001, CISA, CISM, CRISC, CDPSE or PCI DSS-related qualifications
• Experience managing security incidents and crisis situations
• Strong leadership, communication, and decision-making skills