[Hiring] Security Compliance Auditor @Arancia

Role Description

Arancia is seeking a Security Compliance Auditor to lead internal audits, framework and compliance gap assessments, and audit readiness assessments for clients across regulated and high-growth industries. You will assess clients against industry standards and regulatory frameworks, identify where they fall short, and guide them to compliance and audit-ready status. This role focuses on the work that happens before and around an external audit:

• Understanding a client's current compliance posture
• Defining the target state
• Helping remediate gaps
• Preparing teams and evidence for certification or attestation

The ideal candidate combines hands-on audit and assessment experience with a strong grounding in risk management and the ability to turn findings into clear, prioritized roadmaps that technical and business stakeholders can act on.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Accounting, or a related field.
• 3–5 years of experience in IT audit, internal audit, security compliance, or cybersecurity consulting.
• Hands-on experience conducting internal audits, gap assessments, or readiness assessments against at least two of: SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, or NIST frameworks.
• Working knowledge of regulatory and external audit processes, and of what auditors and assessors expect in evidence and documentation.
• Strong understanding of risk management frameworks and methodologies, such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, or ISO 31000.
• Experience translating findings into remediation plans and compliance roadmaps for clients.
• Excellent written and verbal communication skills, with the ability to engage confidently with clients from technical staff to executives.
• Strong analytical and organizational skills, with the ability to manage competing priorities independently.

Requirements

• Lead internal audits, gap assessments, and readiness assessments against industry standards and regulatory frameworks, including SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, HITRUST CSF, FedRAMP, and NIST frameworks.
• Assess clients' current compliance posture by reviewing policies, procedures, control design, implementation, and supporting evidence.
• Lead client interviews, process walkthroughs, control testing, and evidence-review sessions.
• Map controls across multiple frameworks to reduce duplicate effort and give clients a unified view of compliance.
• Apply risk management frameworks such as NIST RMF, NIST SP 800-30, ISO/IEC 27005, ISO 31000, and NIST CSF 2.0 to identify, rate, and prioritize compliance and security risks.
• Help clients build or mature risk registers, risk treatment plans, and risk acceptance processes.
• Communicate risk clearly to both technical teams and executive leadership.
• Help clients define strategic goals for becoming compliant, including target scope, timelines, and certification or attestation milestones.
• Develop prioritized remediation roadmaps that link each gap to its risk, owner, effort, and target date.
• Guide clients through remediation, including policy and procedure development, control implementation, and evidence collection.
• Validate remediation and confirm controls are operating as intended before an external audit.
• Prepare clients for external audits and certifications, including scoping, evidence packages, and mock or pre-assessment walkthroughs.
• Support clients during external audits by coordinating evidence requests and responding to auditor questions alongside the client.
• Help clients interpret and respond to external audit findings and regulatory requirements.
• Prepare clear audit documentation, gap reports, findings, risk ratings, and recommendations for clients and stakeholders.
• Manage multiple concurrent engagements, delivering high-quality work on time and within scope.
• Advise clients on strengthening internal controls, governance, risk management, and compliance programs.

Benefits

• Market-competitive compensation based on experience, qualifications, and expertise.