Security Compliance Specialist II

Role & responsibilities

As a Compliance Specialist II within Security Compliance, you will be a key contributor to Akamais security compliance posture by leading hands-on control testing, risk identification, and audit management.

Specific responsibilities include:

• Controls Testing & Assessment: Execute design and operating effectiveness testing for technical, physical, and operational security controls across primary frameworks such as SOC 2, ISO 27001, and PCI DSS.
• Evidence Collection & Walkthroughs: Coordinate sampling populations, lead technical walkthroughs with Engineering, DevOps, and IT system owners, and review technical evidence.
• Deficiency Analysis & Remediation: Identify control gaps, document exception trends in our GRC platform, and partner with system owners to draft actionable remediation plans and track them to closure.
• Third-Party Audit Support: Serve as a controls liaison during external audits, managing evidence pipelines, helping explain technical control implementations to auditors, and minimizing business disruption.
• Process Optimization: Partner with engineering teams to transition manual control testing toward continuous control monitoring using GRC tooling and automation.

Preferred candidate profile

Applicants must meet one of the following education and experience requirements:

• 4 years of relevant experience and a Bachelors degree or
• Equivalent and, or relevant professional experience

Qualifications

• 4+ years of hands-on experience evaluating or testing security controls against industry standards, with a strong emphasis on SOC 2, ISO 27001, or PCI DSS.
• Working knowledge of core technical security controls (e.g., Identity & Access Management, Change Management, Vulnerability Management, and Logging/Monitoring).
• Strong analytical, problem-solving, and written/verbal communication skills.
• Relevant security or audit certifications (e.g., CISA, CRISC, Security+, CISM, or ISO Lead Auditor) preferred but not required.
• Experience working with cloud infrastructure, containerized environments, or distributed systems preferred but not required.