IT Security Engineer

We'll trust you to:

SOC Audit & Compliance 
• Support SOC 2 (Type I & Type II), Future ISO 27001 readiness, and internal security audits as they relate to SOC and IT operations. 
• Map security and SOC controls to applicable frameworks (AICPA Trust Services Criteria, ITGCs). 
• Coordinate and manage audit evidence collection from SOC, endpoint, identity, and infrastructure teams. 
• Perform control design and operating effectiveness reviews for SOC adjacent controls. 
• Track audit findings, risks, and remediation actions through closure. 
• Maintain continuous audit readiness rather than point-in-time compliance. 
 
Vulnerability & Remediation Governance 
• Partner with IT and GRC to support vulnerability management oversight. 
• Review and validate vulnerability findings from Nessus scans. 
• Track remediation of SLAs, compensating controls, and risk exceptions. 
• Perform remediation validation testing post-patching or configuration changes. 
• Produce vulnerability compliance metrics and audit-ready reports. 
 
Endpoint & Device Security Compliance 
• Support endpoint security control assurance across corporate devices using Microsoft Intune. 
• Validate enforcement of:  
• Device compliance policies 
• Security baselines 
• Patch and configuration standards 
• Support audit evidence related to:  
• Device enrollment 
• Configuration compliance 
• Endpoint protection integration (e.g., Defender ecosystem) 
• Partner with endpoint teams during audits to explain control design and operation. 
 
Data Governance & Compliance 
• Support data protection and information governance controls using Microsoft Purview. 
• Assist in audits related to:  
• Data classification and labelling
• DLP policy enforcement
• Retention and records management 
• Insider risk and audit logging 
• Validate evidence of operational effectiveness for Purview-based controls. 
• Maintain compliance documentation related to data security and privacy controls.
 
Documentation & Stakeholder Coordination
• Maintain SOC-related policies, standards, procedures, and control narratives. 
• Translate technical SOC and security processes into audit-ready documentation. 
• Collaborate with:  
• SOC Operations 
• Endpoint & IAM teams 
• Internal Audit 
• Risk & Compliance stakeholders 
• Prepare audit responses, management action plans, and status reporting. 

You'll need to have:

• 2–6 years of experience in information security, IT audit, SOC governance, or security compliance. 
• Hands-on exposure to SOC audit or compliance activities. 
• Working knowledge of:
• SOC 2 / ITGC concepts 
• Control testing and evidence collection 
 
Preferred Skills & Certifications 
• Familiarity with:  
• ISO 27001 
• NIST CSF / 80053 
• AICPA Trust Services Criteria 
• Experience working with or supporting:  
• Nessus (vulnerability scanning & remediation tracking) 
• Microsoft Intune (device compliance / endpoint security assurance) 
• Microsoft Purview (DLP, data classification, compliance tooling) 
• Strong documentation, analytical, and stakeholder communication skills. 
• Certifications (nice to have, not mandatory):  
• CISA 
• ISO 27001 Foundation or LA 
• CRISC 
• Microsoft Security fundamentals