[Hiring] Senior Audit Program Manager @Nscale

Role Description

We're hiring a Senior Audit Program Manager, Security Assurance to lead security audits and certification programs as Nscale scales its global AI infrastructure. This is a senior individual contributor role reporting to the Director, Security Risk & Compliance. You'll lead assigned SOC 2 and ISO 27001 engagements across cloud services, data centers, and corporate functions, from scoping and readiness through external assessment, remediation, and final reporting.

You'll join our existing Audit and Assurance team, sharing a growing portfolio of audits, certification activities, and scope expansions. You'll own your assigned engagements and workstreams while maintaining a consistent approach to controls, evidence, and auditor engagement across the portfolio.

We're looking for an experienced assurance practitioner who can work directly with engineers, understand how controls operate, and substantiate those controls to external auditors. You'll investigate gaps, bring sound judgment to ambiguous requirements, and recommend practical solutions. You'll also help us scale assurance through reusable evidence, automation, and well-designed workflows.

What you'll be doing

• Audit and Certification Delivery
  • Lead assigned SOC 2 and ISO 27001 engagements, including readiness assessments, scope expansions, ongoing assessments, and remediation.
  • Establish audit plans with clear boundaries, control owners, evidence requirements, milestones, and dependencies.
  • Coordinate observation periods, fieldwork, and report or certificate delivery with external auditors.
  • Serve as the primary auditor contact for your engagements.
  • Lead control walkthroughs, prepare technical teams for interviews, and resolve evidence requests and interpretation questions.
• Audit Coordination and Reporting
  • Manage audit requests, schedules, and status reviews across concurrent engagements.
  • Assign owners, set deadlines, review submissions, document decisions, and drive follow-through on blockers and recovery plans.
  • Prepare audit documentation, including application letters, scoping questionnaires, evidence request lists, and management responses.
  • Review draft reports and certification documents for factual accuracy, scope, and consistency with evidence, and coordinate approvals and signatures.
  • Maintain an organized, version-controlled record of evidence, correspondence, approvals, and final deliverables.
  • Surface delivery risks early with practical recommendations.
• Technical Controls and Evidence Quality
  • Assess control design and operating effectiveness with engineering, security, IT, and business owners.
  • Translate assessment criteria into clear implementation and evidence requirements.
  • Review technical evidence across identity and access management, GPU/compute infrastructure configuration, change management, logging, vulnerability management, backup and recovery, and physical security.
  • Validate evidence before submission, including its source, completeness, relevant population, period, and connection to the control being tested.
  • Investigate discrepancies between documented controls and actual operations.
  • Work with owners to correct the control, documentation, or evidence, and maintain accurate control narratives, framework mappings, and relevant Statement of Applicability inputs.
• Scope Expansion and Shared Responsibilities
  • Assess how new services, sites, entities, and operating models affect audit boundaries and certification coverage.
  • Establish readiness criteria for scope expansion and make coverage gaps and their business implications clear.
  • Work with cloud, infrastructure, data center, and colocation teams to distinguish Nscale-operated controls from provider responsibilities and inherited controls.
  • Evaluate provider reports and certificates for relevant services, locations, periods, exceptions, and customer responsibilities.
  • Identify where additional evidence or assessment is needed.
  • Partner with Customer Trust and Legal to translate validated customer obligations into assurance requirements.
• Findings and Continuous Assurance
  • Turn audit findings and readiness gaps into remediation plans with accountable owners, root causes, due dates, and closure criteria.
  • Challenge incomplete fixes, verify remediation evidence, and coordinate retesting and auditor acceptance where required.
  • Track overdue actions, recurring control failures, and changes that could affect upcoming assessments.
  • Support ISMS reviews and internal assurance activities with accurate audit results, control performance, and improvement recommendations.
• Automation and Program Improvement
  • Partner with Compliance Automation to define evidence requirements, identify reliable source systems, and validate automated collection and monitoring outputs.
  • Build reusable evidence and control mappings that reduce repeated requests while preserving each assessment's scope and period requirements.
  • Improve audit workflows in Drata and connected delivery tools so owners, evidence, findings, and decisions remain traceable.
  • Use AI tools to streamline repeatable assurance work, with appropriate data handling and verification of generated outputs.
• KPIs
  • Audit and certification milestone delivery against agreed plans.
  • Evidence submission readiness, avoidable rework, auditor-query resolution time, and accuracy and completeness of scope records, control ownership, and evidence mappings.
  • Remediation closure against agreed criteria, overdue findings, and recurring issues.
  • Reduction in duplicated evidence requests and manual effort against a defined baseline.

Qualifications

• 7+ years of experience in security assurance, technology audit, compliance, or related disciplines.
• Substantial hands-on experience with both SOC 2 and ISO 27001.
• Experience working directly with external auditors.
• Technical fluency in cloud infrastructure and security controls.
• Experience defining assessment scope and understanding shared responsibilities across internal teams, cloud providers, and other service providers.
• Strong program execution across concurrent engagements.
• Ability to investigate unfamiliar issues independently.
• Clear written communication skills.

Requirements

• Security assurance experience at a cloud service provider, hyperscaler, infrastructure platform, or data center operator.
• Experience expanding audit or certification scope across multiple services, sites, or entities.
• Experience with common control frameworks, evidence reuse, continuous monitoring, and reducing the effort audits require from engineering teams.
• Strong familiarity with AI tools to automate repeatable processes.
• Hands-on experience with Drata or a comparable GRC platform.
• Experience building effective assurance processes in a fast-growing organization.

Benefits

• Highly competitive US compensation package (base + bonus + equity), with performance reviews every 12 months.
• Join one of the fastest-growing AI infrastructure companies.
• Expect a dynamic progression plan tailored to your ambitions.
• Human-First Flexibility: We treat you as humans first.

Equal Opportunities Statement

We strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds. If there’s anything we can do to accommodate your specific situation, please let us know.

The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role.

The range below reflects the base salary for the position. Actual compensation may vary based on job-related factors such as skill set, experience, education, and location. In addition to base salary, this role may be eligible for bonus, equity, and/or commission programs. Nscale may offer a competitive benefits package including medical, dental, vision, flexible paid time off, parental leave, and retirement plan participation.

Salary Range

$140,000 — $180,000 USD