Job Description & Details
This is a solid, compliance-heavy infosec role where you'll spend a lot of time wrangling third-party risk and making sure policies actually hold up in the real world. If you hate paperwork and cross-functional auditing, definitely steer clear—this position lives right at the intersection of security operations and regulatory compliance.
What You'll Actually Be Doing
You'll spend your days drafting, reviewing, and implementing security policies and procedures designed to protect sensitive data while keeping the business compliant with various legal frameworks. A massive chunk of your time will go toward conducting third-party vendor and cloud service risk assessments, meaning you'll need to critically evaluate external partners and figure out how to mitigate whatever gaps they bring to the table. You will also directly support the broader risk management function, tracking down security risks and ensuring they don't slip through the cracks.
The Core Tech Stack
You need a deep, working fluency in major security standards and regulations like PCI DSS, SOX, SOC1, SOC2, and ISO2700x. Because third-party assessments and compliance frameworks are the bread and butter here, knowing how to map controls to these standards is non-negotiable. If you happen to bring specific PCI payment card industry experience to the table, you'll immediately jump to the top of the pile.
Interview Expectations
The hiring team is going to test your practical approach to vendor risk management by asking how you would handle a critical cloud vendor who refuses to remediate a high-severity finding on their SOC 2 report. They want to see if you can balance business enablement with hard risk mitigation without just hiding behind policy. They'll also likely probe your experience with PCI DSS scope reduction or how you handle conflicting priorities between audit compliance and engineering speed.
Application Advice
Your resume needs to heavily feature the exact acronyms listed in the job description, especially PCI DSS, SOC2, and ISO2700x, since the ATS is going to aggressively filter for them. Make sure your summary or bullet points explicitly state your years of experience in third-party risk assessments and IT auditing. If you hold certifications like CISA, CISM, CRISC, or CISSP, put them right at the top so the recruiter doesn't have to hunt for them.