ZipRecruiter

Log In

1

Soc Two Auditor Jobs (NOW HIRING)

UniUni

Senior Security Compliance Engineer

Run the SOC 2 Type II program operations, including continuous control monitoring, evidence collection, auditor coordination, and remediation tracking. * Operate the information security policy ...

OneStudyTeam

Security Compliance Manager

OR · Remote

$140K - $170K/yr

Lead security certification & audit readiness (ISO 27001 / SOC 2): Drive quarterly ISO control ... Evidence management & auditor response: Prepare for internal and external audits by organizing ...

Momentum

GRC Analyst

Dallas, TX

Own the internal SOC 2 Type II evidence collection process, keeping controls audit-ready year-round. Manage the audit timeline, day-to-day liaison with the external auditor, and remediation finding ...

Kikoff

Staff Trust & Assurance Engineer

San Francisco, CA · On-site

$260K - $304K/yr

Own Kikoff's SOC 2 Type II program end-to-end, including scoping, control design, evidence collection, walkthroughs, and external auditor management. * Maintain Kikoff's PCI DSS self-attestation ...

A-LIGN External

OR · On-site

$93K - $123K/yr

Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth ... A-LIGN is the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor. To learn ...

Hearst Newspapers

Security Manager

Tampa, FL

Serve as the primary liaison for external auditors, assessors, and compliance partners. * Prepare audit-ready documentation, evidence, and controls for SOC 2 Type II and HIPAA audits. * Coordinate ...

next page

Showing results 1-20

All JobsSoc Two Auditor Jobs

Soc Two Auditor information

See salary details

$38.5K

$92.8K

$151K

How much do soc two auditor jobs pay per year?

As of Jun 9, 2026, the average yearly pay for soc two auditor in the United States is $92,797.00, according to ZipRecruiter salary data. Most workers in this role earn between $72,000.00 and $112,000.00 per year, depending on experience, location, and employer.

What is the difference between Soc Two Auditor vs Soc Two Consultant?

AspectSoc Two AuditorSoc Two Consultant
CertificationsTypically holds CPA, CISA, or similar certificationsOften has similar certifications but focuses on advisory roles
Work EnvironmentPerforms audits within organizations, often in finance or IT departmentsProvides advisory services, assessments, and recommendations to clients
Employer & Industry UsageEmployed by organizations or audit firms to conduct SOC 2 auditsWorks for consulting firms or independently to advise on SOC 2 compliance

While both roles focus on SOC 2 compliance, a Soc Two Auditor conducts formal audits to assess compliance, whereas a Soc Two Consultant provides guidance and recommendations to help organizations prepare for audits.

More about Soc Two Auditor jobs
What cities are hiring for Soc Two Auditor jobs? Cities with the most Soc Two Auditor job openings:
What states have the most Soc Two Auditor jobs? States with the most job openings for Soc Two Auditor jobs include:
What job categories do people searching Soc Two Auditor jobs look for? The top searched job categories for Soc Two Auditor jobs are:
Soc Two Auditor jobs near you
Infographic showing various Soc Two Auditor job openings in the United States as of May 2026, with employment types broken down into 4% As Needed, 8% Full Time, 75% Part Time, and 13% Contract. Highlights an 95% Physical, 2% Hybrid, and 3% Remote job distribution, with an average salary of $92,797 per year, or $44.6 per hour.

Senior Security Compliance Engineer

UniUni

Remote

Full-time

Posted 12 days ago

Job description

About UniUni
UniUni is a late-stage last-mile logistics company moving millions of parcels across the United States and Canada for some of the largest e-commerce platforms in North America. Our technology is cloud-native on AWS. We hold an active ISO 27001 certification and SOC 2 Type II attestation, and security and compliance are central to how we operate and how our customers trust us. This role reports to the Information Security Officer and is based in North America (remote with periodic travel to UniUni hubs).
About the role
  • We are hiring a Senior Security Compliance Engineer to be the operational backbone of UniUni's governance, risk, and compliance function. You will run the day-to-day machinery that keeps our ISO 27001 certification and SOC 2 Type II attestation healthy, our policies current, our customers confident, and our regulatory obligations met.
  • This is a hands-on senior IC role. The Information Security Officer designs the program; you make it work. You will run audit cycles, manage evidence, drive policy lifecycles, lead customer security reviews, operate the third-party risk program, and support privacy and regulatory work. We are looking for someone who automates what should be automated, writes clearly, and treats compliance as a real engineering problem.

What you'll do
Core GRC
  • Run the ISO 27001 program operations, including surveillance audit prep, internal audits, the annual risk assessment, management reviews, and corrective action tracking.
  • Run the SOC 2 Type II program operations, including continuous control monitoring, evidence collection, auditor coordination, and remediation tracking.
  • Operate the information security policy lifecycle: drafting, stakeholder review, approval workflows, annual reviews, version control, and employee attestations.
  • Maintain the risk register, drive risk treatment plans through to closure, and prepare risk reporting for the ISO and the executive team.
  • Build and maintain compliance automation, including evidence collection workflows, control testing, and dashboarding. Treat the GRC platform as a system you actively engineer, not a passive system of record.
  • Plan and run security awareness training and phishing simulation cycles, and report on outcomes.

Privacy and Regulatory
  • Operate UniUni's privacy program in partnership with legal, including data inventories, data flow mapping, retention schedules, and privacy impact assessments.
  • Execute on regulatory obligations relevant to our business, including the DOJ Data Security Program, Canadian PIPEDA, and applicable US state privacy laws.
  • Coordinate the response to data subject access requests (DSARs) and privacy inquiries within statutory timelines.
  • Track regulatory developments across the jurisdictions in which UniUni operates and translate them into concrete control changes, evidence requirements, and policy updates.
  • Support data residency and data minimization commitments, working with engineering and the data security team to verify they hold in practice.

Customer Reviews and Third-Party Risk
  • Lead the response to customer security questionnaires, RFP security sections, and prospect security reviews, in partnership with sales, legal, and the ISO.
  • Review and negotiate the security and privacy clauses in customer and vendor contracts, escalating material issues to the ISO and legal.
  • Run UniUni's third-party risk management program: vendor inventory, tiering by risk, due diligence, security review of new vendors, periodic reassessment of existing vendors, and remediation tracking.
  • Operate the trust center and the security artifact library (SOC 2 reports, ISO certificates, pen test summaries, security overviews) and keep customer-facing materials current and accurate.

Across All of It
  • Be a credible representative of UniUni's security posture in front of customers, auditors, and regulators.
  • Write clearly and precisely. The work product of this role lands in front of customers, auditors, regulators, and executives, and it has to hold up.
  • Partner with engineering, IT, legal, HR, and finance to make compliance a normal part of how the business runs, not an interrupt.

Qualifications
  • 5 to 8 years in security GRC, audit, or a closely related discipline, with hands-on ownership of ISO 27001 and SOC 2 program operations in a cloud-native organization.
  • Direct experience driving SOC 2 Type II audit cycles end to end, including auditor coordination, evidence collection, and remediation.
  • Working knowledge of common control frameworks beyond ISO and SOC (NIST CSF, NIST 800-53, CIS) and the ability to map between them.
  • Experience operating a GRC platform (e.g., Vanta, Drata, Secureframe, Hyperproof, ServiceNow GRC, OneTrust) as a power user, including building automated evidence pipelines and control tests.
  • Experience leading customer security questionnaires and security reviews for enterprise customers, including reviewing security and privacy clauses in contracts.
  • Familiarity with privacy regulation in North America, including PIPEDA and US state privacy laws, and a working understanding of cross-border data transfer requirements.
  • Experience operating a third-party risk management program at meaningful vendor volume.
  • Strong written communication. You can produce auditor-ready documentation, customer-ready security narratives, and executive-ready risk summaries, and you know which is which.
  • A pragmatic, automation-first mindset. You are bothered by manual evidence collection and you do something about it

Nice to Have
  • Experience in logistics, supply chain, marketplaces, or other high-volume operational businesses.
  • Familiarity with the DOJ Data Security Program and bulk data transfer rules.
  • Light scripting ability (Python, SQL) for automating evidence collection or building control queries against AWS, identity providers, and SaaS platforms.
  • Relevant certifications such as ISO 27001 Lead Auditor or Lead Implementer, CISA, CISM, CIPP, or CRISC.
  • Prior experience supporting a company through a customer-driven security maturation, an investor due diligence cycle, or IPO readiness.

Why This Role
This is a senior IC role with end-to-end ownership and visible impact. You will work directly with the Information Security Officer in a security function with executive commitment, a live ISO 27001 certification, and an active SOC 2 Type II attestation. You will be in the room for customer security conversations, in the loop on regulatory questions, and in the driver's seat on the audit cycles that protect both.

Apply