200+ applicants

Company

HashiCorp · 9 hours ago

Senior Compliance Specialist, Governance, Risk and Compliance

United States

Full-time

Remote

Senior Level, Lead/Staff

$183K/yr - $215K/yr

8+ years exp

Maximize your interview chances

Cloud InfrastructureCyber Security

No H1B

Insider Connection @HashiCorp

Discover valuable connections within the company who might provide insights and potential referrals.
Get 3x more responses when you reach out via email instead of LinkedIn.

Responsibilities

Help oversee and mentor existing compliance analyst(s)

Work with external auditors and controls owners on SOC 2 and ISO 27001/17/18 including:

Ensure contracting is in place with external auditor to conduct attestation/certifications on an annual basis

Confirm scope of SOC 2 and ISO audits

Prepare the ISO scope documentation and Statement of Applicability (SOA)

Develop project plan including key milestones and timelines, working with HashiCorp’s auditor

Identify and confirm control owners before the audit begins

Prepare control owners for external assessments

Prepare internal communications, including weekly status updates that outline the status of the program, potential risks and call to action items

Host walkthroughs and prepare and/or review walkthrough agendas

Perform the final review of evidence that is gathered by control owners before submitting to the auditors

Monitoring and tracking control exceptions, if applicable, and help teams create remediation plans for gaps/audit findings

Development of the system description, including working with relevant control owners for input

Prepare and facilitate regular management reviews as part of ISO 27001

Provide program oversight of the annual ISO Internal Audit

Maintain and document the scope/boundaries of the compliance program (cloud accounts, repositories, Github teams, etc.) including updates, removals and additions.

Identify and propose improvement to the Security Policy and participate in the annual Security Policy review

Support requests received for Security Policy exceptions, including following up on approved exceptions expiring.

Maintain documentation such as HashiCorp’s Common Control Framework (CCF), including developing new controls, completeness and accuracy of the information including framework mappings

Work with controls owners to identify opportunities for automating manual processes and controls

Develop, maintain and deliver on control owner enablement trainings

Provide input on program metrics and collect and report on metrics data

Support other GRC tasks as required

Qualification

Find out how your skills align with this job's requirements. If anything seems off, you can easily click on the tags to select or unselect skills to reflect your actual expertise.

Compliance program experienceSOC 2 knowledgeISO 27001 knowledgeAudit experienceCloud environment experienceMulti-cloud environment experienceSecurity compliance frameworksAWS experienceAzure experienceAutomation of processesOSCAL experienceTraining developmentResponsivenessTechnical communicationProject management