Audit and Compliance Specialist

Overview

JOB DESCRIPTION: Audit and Compliance Specialist – Governance, Risk & Compliance

• JOB IDENTIFICATION

• APTEAN JOB TABLE: Information Security
• APTEAN JOB LEVEL: B
• APTEAN JOB TITLE: Audit and Compliance Specialist – Governance, Risk & Compliance
• REPORTS TOFull line: Director, Information SecurityDotted line: Lead Audit and Compliance Specialist

• GENERAL JOB SUMMARY

The Audit and Compliance Specialist – Governance, Risk & Compliance performs the assurance activities of the Aptean Information Security Office: testing whether security controls are designed adequately and operating effectively, producing the evidence that demonstrates it, and assessing third parties, products and AI systems against Aptean control requirements. The role supports external audits and certification assessments, coordinates technical security assessments, authors security policies, standards and department handbooks, and administers the exception and control registers.

• SCOPE

Knowledge:Possesses extensive experience and deep expertise in the field. Effectively resolves a broad range of challenges using sound judgment, creativity, and practical knowledge. Recognized as a fully proficient professional who can operate independently within their area of specialization.

Complexity:Manages diverse and complex assignments that require thorough analysis and evaluation of multiple factors. Demonstrates strong decision-making skills in selecting appropriate methods, techniques, and solutions. Regularly collaborates and builds relationships with senior internal and external stakeholders.

Supervision:Works with a high degree of autonomy and receives minimal day-to-day supervision. Typically requires only general direction for new or unique assignments while independently managing routine responsibilities.

• ORGANIZATION

Full line

• Director, Information Security

Dotted line

Lead Audit and Compliance Specialist

• PRINCIPAL DUTIES AND RESPONSIBILITIES

Executes control testing against the information security control framework on the defined cycle, including sampling, test procedures and documented conclusions on operating effectiveness.

Assesses control evidence for sufficiency, records findings with severity, root cause and accountable owner, and validates remediation evidence before closing findings raised by the function.

Supports external audits, certification assessments and customer-driven assessments through evidence preparation, request tracking, auditor liaison and follow-up submissions.

Coordinates technical security assessments: defines scope against control, certification and contractual requirements, manages independent assessors, reviews deliverable quality, and registers resulting findings for tracking.

Conducts pre-engagement and periodic third-party security and privacy due diligence assessments, reviews vendor assurance artefacts and contractual security requirements, and issues documented risk opinions.

Assesses AI systems against applicable security control requirements, performs AI audit and assurance activity, and provides security input to AI risk categorisation and operator role determination undertaken by the governance function.

Drafts and maintains security policies, standards and department security handbooks, working with subject matter experts to define applicable controls, expected evidence and accountable owners.

Administers the exception and risk registers, monitors expiry, produces recurring compliance and control reporting for management and governance committees, and performs other related duties as assigned.

• JOB SPECIFICATIONS

Education

Required Preferred Degree/Certification

• ☒ ☐ Bachelor’s degree
• ☐ ☐ Master’s degree
• ☐ ☐ Ph.D.

☐ ☐ J.D. (law)

☐ ☒ Certification: ISO 27001 Lead Auditor/Lead Implementer, CISA, CCSK

☐ ☐ Registration

☐ ☐ Licensure

☐ ☐ Other

Work Experience

4 years of experience in information security in a dedicated governance, risk and compliance, security compliance or IT audit role.

Knowledge

• Information security control frameworks – SOC1, SOC 2, SOC3, ISO 27001, ISO 42001 and NIST 800-53 or NIST CSF – including control interpretation and evidence requirements.
• Audit and assessment practice, including sampling, evidence sufficiency, finding classification and corrective action tracking.
• Third-party and vendor security risk assessment methodology, contractual security requirements and assurance artefact review.
• Artificial intelligence governance and AI security requirements, including risk-tiering under the EU AI Act, operator role concepts, ISO 42001, and how AI systems are assessed against security controls.
• Security documentation hierarchy – how policy, standards, baselines, procedures and department handbooks relate to one another.
• Cloud security concepts across at least one major provider, sufficient to interpret cloud control requirements and assess supporting evidence.
• Data protection principles and regulatory obligations, including GDPR and privacy assessment processes.

Skills and Abilities

• Writes clearly and precisely in English. A substantial part of the role produces documentation that non-security teams must follow and auditors must rely on; writing ability is assessed during selection.
• Reaches supportable conclusions from incomplete evidence, and states limitations rather than overstating assurance.
• Distinguishes an isolated control failure from a systemic control weakness and escalates accordingly.
• Scopes, commissions and challenges assessments delivered by specialist third parties without performing the technical work.
• Works effectively with technical teams without owning their work – asks precise questions, obtains attributable answers, and escalates where accountability is declined.
• Manages concurrent assurance activities against defined cycles and reports slippage when it occurs rather than at the milestone date.
• Maintains accuracy and traceability in registers, evidence records and reporting.
• Applies professional scepticism and maintains an independent position under commercial or delivery pressure.

DISCLAIMER

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.