Senior Associate, Compliance

Responsibilities

• Support HITRUST, SOC 2, HIPAA-related, and other compliance audits and assessments from planning through completion.
• Review audit criteria, control requirements, prior-year findings, and auditor requests to identify required evidence and stakeholder inputs.
• Coordinate evidence collection with control owners across Information Security, Engineering, Infrastructure, Product, Legal, People, Finance, and other business teams.
• Gather, organize, track, and quality-check evidence for completeness, currency, relevance, and accurate control mapping.
• Prepare evidence packages, control narratives, management responses, and supporting documentation for auditors.
• Manage audit request lists, project plans, deadlines, status reporting, action-item logs, and escalation paths.
• Identify evidence gaps and improve control documentation, ownership, consistency, and repeatability.
• Support auditor meetings, walkthroughs, interviews, follow-up questions, and additional information requests.
• Track observations, exceptions, and remediation commitments through resolution and validate closure evidence.
• Help build scalable audit operations using standardized repositories, reusable narratives, calendars, templates, automation, and reporting.
• Maintain compliance program documentation and contribute to reporting on audit readiness, open gaps, and program health.

Requirements

• 4–7 years of experience in IT audit, compliance, information security, privacy, risk management, internal controls, or a related field.
• Familiarity with compliance frameworks, control testing, audit evidence, and security and privacy requirements.
• Exposure to HITRUST, SOC 2, HIPAA, NIST, ISO 27001, or similar frameworks and assessment processes.
• Experience gathering and reviewing policies, procedures, tickets, access reviews, training records, system configurations, logs, reports, and meeting artifacts.
• Strong project management, written communication, verbal communication, documentation, follow-up, and quality-assurance skills.
• Comfort using spreadsheets, ticketing systems, shared documentation platforms, GRC tools, and other audit-management systems.
• Ability to identify process gaps, recommend practical improvements, work independently, and collaborate with technical and non-technical stakeholders.
• Bachelor’s degree in accounting, information systems, cybersecurity, business, or a related field preferred.

Nice-to-haves

• CISA, CIA, CRISC, Security+, or another relevant certification.

Benefits

• Competitive compensation package with medical insurance.
• Catered lunches and additional workplace perks.
• Daycare reimbursement.
• Cellphone and Wi-Fi reimbursement.
• Competitive parental leave.
• Sabbatical leave after five years.
• Annual sponsored health check-ups.