InvestCloud, Inc.

Compliance

• Maintain hardened baselines and secure configurations across systems and environments, mapped to policy and control requirements.
• Proactively monitor for issues, investigate anomalies, and help drive timely remediation, with strong documentation and traceability.
• Produce high-quality control documentation and evidence that stand up to internal audit, external audit, and client scrutiny.
• Collaborate effectively with technical and non-technical stakeholders to embed security and compliance expectations into day-to-day operations.
• Support execution of compliance and security risk assessments by gathering inputs from control owners, documenting risks, and tracking agreed actions.
• Help design and execute control testing plans for key information security and compliance controls (e.g., access reviews, configuration baselines, logging and monitoring), documenting results and exceptions.
• Maintain and refine control inventories, risk registers, and metrics/KRIs for information security and compliance, partnering with the Information Security Manager and Compliance to ensure data quality and timely updates.
• Assist in evaluating the impact of new regulations, client obligations, and internal policies on existing controls, and help translate requirements into practical control changes.
• Prepare and maintain control evidence (e.g., screenshots, configuration exports, reports, tickets) that demonstrate effective operation of information security and compliance controls for internal and external audits.
• Partner with Compliance, Legal, and Information Security leadership to support SOC 2, ISO 27001, and related certification activities, including evidence collection, sample selection, and responses to auditor questions.
• Coordinate and contribute to client security and compliance questionnaires, RFPs, and on-site/virtual reviews by providing accurate, timely information on controls, hardening standards, and governance processes.
• Help organize and track findings and remediation actions arising from audits, certification reviews, and client / regulatory inquiries, ensuring owners, timelines, and status are clearly documented.
• Ensure that day-to-day security and compliance practices align with written policies by reviewing procedures, identifying gaps, and proposing pragmatic updates.
• Support the Information Security Manager and Compliance in reviewing, updating, and socializing policies, standards, and procedures, including mapping controls to specific requirements and frameworks.
• Assist with access control and entitlement governance, including periodic user access reviews, privileged account checks, and validation of joiner/mover/leaver activities against policy and client expectations.
• Help document and refine standard operating procedures (SOPs) for recurring controls (e.g., monitoring, evidence collection, configuration reviews, access reviews), ensuring they are clear, consistent, and audit-ready.
• Operate day-to-day security monitoring processes, including review of alerts, logs, and dashboards for suspicious activity, misconfigurations, and policy exceptions, ensuring that events are handled in line with documented procedures.
• Conduct initial triage and investigation of security and control-related events; document findings, classify impact and risk, and escalate to the Information Security Manager or other stakeholders as appropriate.
• Support ongoing vulnerability, patching, and configuration management efforts by validating remediation status, tracking exceptions against policy and risk tolerance, and helping prioritize issues based on business and client impact.
• Work closely with Information Security, Compliance, Legal, Infrastructure/Operations, Engineering, and Client-facing teams to clarify security and compliance requirements and ensure shared understanding of control expectations.
• Participate in root-cause analysis and remediation planning for security findings, audit issues, client concerns, and control failures; help ensure corrective actions are risk-appropriate and sustainable.
• Identify opportunities to streamline and automate compliance and security processes to improve consistency, coverage, and efficiency.
• Contribute to training and awareness efforts by providing practical input on technical control topics for relevant audiences.

Senior Specialist, Compliance