The position combines hands-on technical security knowledge with strong GRC capability, including SOC 2, ISO 27001 compliance, risk management, vulnerability management, third-party assurance, client security reviews, evidence management, and policy/control lifecycle management. Demonstrated experience with recognized security and assurance frameworks such as SOC 2 Type II, ISO 27001/27002, NIST CSF, CIS Controls, COBIT, or equivalent control frameworks, including practical control design, implementation, evidence collection, and remediation tracking.