SOC 2 Readiness & Audit Analyst

As a SOC 2 Readiness & Audit Analyst, you will serve as a key execution lead for our information security compliance programs. You will be responsible for driving continuous audit readiness by evaluating control design, testing operating effectiveness, and collecting audit evidence across applicable AICPA Trust Services Criteria. In this role, you will work directly with internal teams to remediate control gaps ahead of observation windows, maintain control matrices within GRC platforms (such as Vanta, Drata, or AuditBoard), and support external auditor requests during Type I and Type II audits. This position is ideal for a detail-oriented compliance professional looking to manage end-to-end evidence workflows, assess third-party vendor risks, and maintain robust security governance.

• Support Program Execution: Assist in the daily operations and execution of the SOC 2 compliance program, helping gather artifacts and document control designs.

• Continuous Control Testing: Perform periodic testing of operating effectiveness across key security controls to maintain ongoing audit readiness throughout the year.

• Assist with Gap Assessments: Conduct preliminary readiness reviews and gap assessments ahead of audit windows, working with control owners to track remediation tasks to completion.

• Evidence & Artifact Collection: Coordinate with cross-functional teams to gather, validate, and organize evidence samples for internal reviews and external audit requests.

• Audit Liaison Support: Assist with managing external auditor requests, including maintaining the Prepared-By-Client (PBC) request list, scheduling walkthroughs, and tracking sample requests.

• Control Matrix Maintenance: Help update and maintain the control mapping matrix across applicable Trust Services Criteria (TSC) and internal security frameworks.

• Third-Party Risk Support: Assist in reviewing third-party vendor SOC reports (subservice organizations), identifying complementary user entity controls (CUECs), and logging potential risks.

• Two years minimum experience. Bachelor's with equivalency accepted.
• Understanding of the five Trust Services Criteria — Security as the mandatory common criteria, plus Availability, Processing Integrity, Confidentiality, and Privacy.
• Ability to articulate Type I versus Type II precisely: Type I is a design opinion at a point in time; Type II tests operating effectiveness over an observation period, usually three to twelve months.
• Multi-framework exposure and GRC platform experience.
• Auditor-facing written and verbal communication.

• CISA or CPA Certification: Preferred signature credentials for GRC and audit alignment.
• Continuous Risk Assessments: Hands-on experience executing ongoing, real-time control monitoring.
• Subservice Provider Scrutiny: Experience evaluating third-party vendor risks and complementary user entity controls (CUECs).
• Large Control Environments: Ability to manage, test, and maintain extensive control sets (150+ controls).

• A direct line to the hiring team. BLUU KAZI presents your profile in person, so your application never disappears into a portal.
• Coaching at every stage. Interview preparation, feedback after each round and support through the offer.
• Room to grow. Access to BLUU KAZI training and certification paths in cybersecurity, cloud and AI.
• A bench that works for you. Join our network of emerging and veteran technologists and hear first about roles that fit.