Technology Compliance Associate

• Operate SOC 2 compliance program including control frameworks, evidence collection, audit coordination, and certification maintenance
• Conduct security risk assessments, phishing simulations, vulnerability management, and penetration testing coordination
• Drive BCP/DR planning, testing, and documentation
• Manage security incident response processes and post-incident reviews
• Track and report on security metrics, compliance posture, and risk remediation

• Day-to-day operational oversight of CrowdStrike Falcon Complete including alert triage, monitoring, and liaising with security engineering on configuration and escalations
• Support identity and access management programs including employee access reviews and privileged access controls
• Tracking and reporting on vulnerability scan findings; coordinating remediation workflows with engineering
• Coordinating and managing third-party penetration testing engagements; tracking findings through to remediation

• Own and manage the end-to-end DDQ (Due Diligence Questionnaire) process, including response accuracy, version control, and automation initiatives; serve as the primary point of contact for client and prospect security questionnaires
• Conduct vendor security assessments and manage third-party risk
• Support legal and compliance teams on vendor contracts and technical due diligence

About you.

• Experience: 4+ years in information security or GRC/Compliance with hands-on technical experience and demonstrated leadership
• Technical depth: Familiarity with cloud security (AWS required, GCP valued), security tooling (CrowdStrike or similar EDR/XDR platforms), and infrastructure security controls
• AI security knowledge: Understanding of AI/LLM security risks, data privacy concerns, and emerging AI governance frameworks (NIST AI RMF, EU AI Act)
• SOC 2 expertise: Operational experience running SOC 2 programs in production environments with successful audit outcomes
• Security frameworks: Working knowledge of SOC 2, ISO 27001, NIST frameworks and their practical application
• Client-facing skills: Proven ability to communicate security concepts to institutional clients and represent technical capabilities professionally
• Compliance knowledge: Experience with security compliance in financial services or other regulated industries
• Communication: Excellent written and verbal skills across technical and non-technical audiences
• Certifications: CISSP, CISM, Security+, or equivalent preferred
• Education : Bachelor's degree in Computer Science, Information Security, or related field

You'll work with:

• Security Tools: CrowdStrike Falcon Complete, Vanta, vulnerability scanners
• AI & Observability: AI Gateway tools, LLM monitoring platforms, observability tools
• Infrastructure: Cloud-native services
• Compliance Frameworks: SOC 2, ISO 27001, NIST
• Identity & Access: SSO, MFA, access control systems

• Highly competitive compensation
• Fully paid medical, dental and vision coverage
• Remote work flexibility
• Team-oriented and collaborative company culture

In compliance with New York City Pay Transparency Law, the base salary range for this role in New York City is between $150,000 - $175,000.

This range does not include discretionary bonus or other forms of compensation or benefits offered in connection with this job.

Several factors are considered when determining a candidate's compensation.

Please note that the salary range listed for this position is based on the level of experience outlined in the job description.

If a candidate's experience differs from the requirements, the salary may be adjusted accordingly.

Trumid is an equal opportunity employer.

Please note: All communication from Trumid's recruiting team comes from @trumid.com email addresses.

We conduct remote interviews via Zoom only.

We will never ask you to purchase equipment, download software (other than Zoom), or share sensitive personal information during the hiring process.