Senior Security Compliance Consultant (SOC 2 & GRC Specialist) - remote job

Toptal is hiring a Senior Security Compliance Consultant (SOC 2 & GRC Specialist) - a senior role, so the employer expects you to make the calls yourself. The role sits in IT and programming and is fully remote. The company places no restriction on where the candidate lives, so you can apply from anywhere.

The employer did not publish a figure; that is settled at interview. The advert sets no condition on working hours.

This vacancy passed an automated check: the list excludes any advert requiring a foreign work permit, visa sponsorship, a particular citizenship, or residence in a specific country.

Headquarters:

Summary We are looking for a seasoned, hands-on Senior Security Compliance Consultant (SOC 2 & GRC Specialist) to spearhead a crucial, company-wide initiative for SOC 2 Type II audit readiness. In this key role, you will conduct thorough gap analyses, evaluate current security controls, develop robust compliance processes, and lead cross-functional teams towards audit completion. The perfect candidate will bring a strong background in GRC frameworks, control mapping, evidence automation, and policy creation. Utilizing automated compliance software like Sprinto, you will establish repeatable compliance procedures, verify technical controls, and ensure a smooth audit process across the entire organization. About the Client Our client is a rapidly growing, cloud-based technology company dedicated to maintaining high-level trust, security, and data privacy. To support their swift commercial expansion and robust sales pipeline, they are developing a structured, highly organized security governance framework. They operate in a modern, cloud-centric environment where compliance is viewed as an active, automated operational benefit, not just a passive checklist. By harnessing modern GRC platforms and promoting a security-focused culture, they create a dynamic environment for compliance experts to drive meaningful architectural and procedural enhancements. Tasks and Deliverables SOC 2 Readiness & Gap Analysis: Perform an in-depth evaluation of existing technical and operational security controls, identifying compliance gaps and creating an actionable remediation plan. Control Design & Implementation: Draft, refine, and operationalize security controls, policies, and procedures that align with SOC 2 Trust Services Criteria (TSC) and PCI DSS standards. Automated Evidence Collection: Lead evidence-gathering processes using automated GRC tools (Sprinto), ensuring all technical documentation, access logs, and policy validations are ready for audit. PCI DSS Guidance: Offer expert advice on maintaining PCI DSS compliance while adhering to SOC 2, efficiently mapping overlapping control requirements to minimize operational challenges. Cross-Functional Coordination: Work closely with engineering, DevOps, HR, and IT teams to integrate compliance workflows into daily operations without hindering feature development. Auditor Interface & Readiness: Serve as the main point of contact during the audit preparation phase, collaborating directly with external auditors to present evidence, address findings, and ensure a successful audit cycle. Required Experience SOC 2 Expertise: Demonstrated experience in leading comprehensive SOC 2 readiness, gap remediation, and audit preparation projects for cloud-native or B2B SaaS companies. GRC & PCI DSS Knowledge: In-depth understanding of Governance, Risk, and Compliance (GRC) frameworks, risk assessment techniques, and PCI DSS compliance rules. Tooling Expertise (Sprinto): Practical experience with automated compliance and evidence-collection platforms, particularly Sprinto (or similar modern tools like Vanta/Drata). Policy & Control Mapping: Exceptional ability to create clear, enforceable security policies and convert abstract regulatory demands into specific engineering controls. Cross-Functional Skills: Strong communication and collaboration skills, with a proven track record of driving accountability across distributed engineering, product, and operations teams.

To apply: [Link to Remote Job Listing]