Senior Commercial Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the audit and certification schedule for Rubrik's active portfolio, including SOC 1, SOC 2, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 42001, CSA STAR Level 1 and Level 2, TISAX Level 1 and Level 2, HITRUST, and HIPAA.

• Act as the main liaison for external auditors and certification organizations, overseeing scoping, fieldwork, evidence requests, and the resolution of findings until they are closed.

• Ensure the mapping of compliance controls to underlying evidence sources is maintained for ongoing audit readiness.

• Lead a unified audit strategy by consolidating overlapping evidence requests across various frameworks.

• Spearhead the evaluation and scoping of new and upcoming certifications to facilitate international expansion and AI governance initiatives.

• Oversee the entire lifecycle of certifications, including retirements and transitions.

• Monitor and report the status of audits, findings, and remediation progress to leadership through Jira-based tracking dashboards.

• Collaborate with control owners from InfoSec, IT, Legal, and Engineering to collect evidence and ensure timely closure of audit findings.

• Work together with Risk Management to integrate audit findings into the comprehensive risk register and remediation process.

• Assist Customer Trust Enablement by ensuring that audit and certification outcomes are effective for customer security inquiries.

• Utilize AI and automation to enhance the processes of evidence collection, control testing, and audit workflows.

⛳️ Requirements

• A minimum of 5 years of experience in security compliance, audit management, or GRC.

• Practical experience managing SOC 2, ISO 27001, and ISO 42001 audits, in addition to at least one other framework.

• Experience working closely with external auditors and certification bodies, including scoping and negotiating audit timelines.

• Strong project management abilities, capable of handling multiple concurrent audit cycles.

• Familiarity with GRC tools and ticketing systems (e.g., Jira) for tracking evidence and remediation efforts.

• Excellent written and verbal communication skills.

• Understanding of regulatory and contractual compliance requirements pertinent to enterprise SaaS/security vendors.

• Detail-oriented mindset.

🏝️ Benefits

• Bonus potential.

• Equity.

• Comprehensive benefits.

• Reasonable accommodations for qualified applicants and employees with disabilities.

• Equal access to growth and success opportunities for all employees worldwide.