Information Security & Compliance Consultant

Job Summary

About the Role We are looking for experienced Information Security and Compliance Consultants with hands-on experience in ISO 27001, SOC 1, and/or SOC 2 engagements. Selected candidates will support certification and compliance-related projects, working with client stakeholders on readiness assessments, gap analysis, control design and testing, evidence collection, and audit documentation. Candidates will undergo a competency assessment and verification of their professional certifications and relevant engagement experience before onboarding with our certification and assurance partner.

Responsibilities

• Deliver ISO 27001, SOC 1, and/or SOC 2 readiness and compliance engagements.
• Conduct information security assessments, gap analyses, and risk assessments.
• Support the implementation, documentation, and testing of internal controls.
• Work with client control owners to collect, review, and validate audit evidence.
• Assist with audit preparation, compliance documentation, and report writing.
• Map controls against applicable frameworks, including ISO 27001, NIST, and COBIT.
• Support the preparation and maintenance of ISO 27001:2022 documentation, including Annex A controls and the Statement of Applicability.
• Understand and apply the relevant SOC 1 requirements (SSAE 18 / ISAE 3402) and SOC 2 Trust Services Criteria.
• Communicate findings, control gaps, remediation recommendations, and project progress to stakeholders.
• Participate in competency assessments and professional credential verification.

Mandatory Requirements

• Minimum 5 years of experience in information security, IT audit, risk management, or compliance.
• Hands-on experience delivering at least two relevant ISO 27001 or SOC 1/SOC 2 engagements, covering activities such as readiness assessments, gap analysis, control design and testing, or audit support.
• Experience working directly with client control owners, collecting audit evidence, and preparing audit documentation or reports.
• Strong understanding of risk assessment methodologies and information security control frameworks.
• Excellent analytical, documentation, report-writing, and stakeholder communication skills.

Certifications

• ISO 27001 Lead Auditor
• ISO 27001 Lead Implementer
• CISA - Certified Information Systems Auditor
• CISSP - Certified Information Systems Security Professional
• CISM - Certified Information Security Manager
• CRISC - Certified in Risk and Information Systems Control
• CPA or equivalent professional accounting qualification, with relevant SOC 1/SOC 2 experience for SOC-focused engagements

Additional Knowledge

• ISO/IEC 27001:2022 requirements, Annex A controls, and Statement of Applicability.
• SOC 1 and SOC 2 engagement methodologies and control requirements.
• Risk assessment, control testing, evidence validation, and remediation tracking.
• Familiarity with NIST, COBIT, and related risk and control frameworks.