[Hiring] Security Compliance Specialist @Harris Computer

Role Description

Security Guidance for Certification Readiness

• Advises business units on security requirements applicable to their certification, attestation, assessment, or regulatory scope (e.g., SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, and applicable Nacha requirements).
• Reviews security documentation, policies, and procedures for completeness and alignment with certification requirements and other applicable security and compliance obligations.
• Identifies security-related gaps that may need remediation prior to an external audit.
• Advises on proactive evidence collection, encouraging early and continuous evidence gathering rather than waiting for detailed requests.

Documentation Standards Guidance

• Advises businesses that meetings related to internal audits, business continuity, disaster recovery, and external penetration tests should be well documented with agendas and minutes.
• Reviews documentation practices to confirm they will hold up to auditor scrutiny from a security perspective.

Shared Services & Third-Party Scoping

• Provides security-focused input on how shared services and corporate/administrative support functions should be classified within the audit scope.
• Advises on scenarios where a business unit relies on a shared services provider for security-relevant reporting.
• Recommends involving the shared services provider as early as possible in the audit, assessment, or certification process.

Security Control Recommendations

• Recommends security controls and improvements needed to satisfy the requirements of the applicable framework.
• Provides guidance on password settings, patching cadence, and other technical security configurations.
• Reviews penetration test scope and results to determine whether they provide appropriate evidence for applicable audit, assessment, or certification requirements.

Audit Coordination Support

• Works in coordination with the business unit's internal audit team and external auditors throughout the audit, assessment, or certification process.
• Participates in audit planning discussions to ensure security evidence and controls are appropriately represented.
• Supports communication between the business unit and any shared services or corporate support functions needed to fulfill audit evidence requests.
• Assists in tracking security-related audit findings through to remediation and closure.
• Collaborates with corporate support functions when their services fall within the audit scope.

Qualifications

• Security & Compliance Experience
• Documentation & Standards Knowledge
• Required Training and Education
• Preferred Certifications

Requirements

• Three or more years of relevant experience assessing security and compliance requirements.
• Experience advising on security controls required for SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, and Nacha requirements.
• Familiarity with common security evidence requirements referenced during audits.
• Understanding of inclusive vs. carve-out scoping considerations for shared services or third-party relationships.
• Experience coordinating with internal audit teams, external auditors, and corporate support functions.
• Understanding of documentation standards expected for internal audits, business continuity, disaster recovery, and penetration testing activities.
• Experience evaluating the design, implementation, and operating effectiveness of administrative and technical security controls.
• Bachelor's degree in Information Security, Computer Science, or related field.
• Equivalent work experience may substitute for degree requirement.

Benefits

• The potential salary range for this role is $80,000 to $90,000 per year.
• Eligibility for bonus or merit program.
• Competitive Total Rewards program including health benefits, RRSP matching, stock option, and career development opportunities.

Key Deliverables

• Security gap analysis reports.
• Security control recommendations for audit readiness.
• Guidance documentation on evidence types typically requested by auditors.
• Security-focused scoping recommendations for shared services relationships.
• Coordination notes/reports supporting audit evidence collection timelines.