Audit and Compliance Analyst

The Audit & Compliance Analyst is responsible for internal controls as well as the success of the RouteOne Information Compliance, Audit, Risk and Governance Program. This program is designed to protect company information, data and facilities; maintain the security of assets; and to ensure the efficacy of and compliance with internal controls. The overall goal is to design, develop, implement, and maintain compliance to a comprehensive information security program that is appropriate to the sensitivity of the information and data that is scoped adequately for the size, complexity, nature, and risk of RouteOne’s business activities. The ideal candidate will have the skill to communicate the details of this program, in writing and speaking, to management, external auditors and customers, regardless of their technical or non-technical backgrounds.

Job Requirements

• Execute and manage internal audits.
• Collect and maintain audit evidence for annual SOC (Service Organization Control) and GLBA audits derived from results of internal audits, including documentation of deviations
• Participate in audits of RouteOne’s vendors and perform subsequent remediation tracking to closure.
• Respond to audits from finance sources and other partners including participating and leading in-person or virtual audit sessions, answering detailed questionnaires, and gathering and providing evidence as well as managing remediation of findings from these audits
• Respond to due diligence requests from finance sources and other partners, providing documentation such as SOC reports, finance reports, and other evidence
• Design new controls and subsequent documentation updates to policies and procedures to close audit findings. Review reports generated from various monitoring and scanning tools and escalate to Security Team appropriately
• Collect data, produce reports, and analyze metrics from audits conducted to evaluate compliance, and collaborate with internal IT Teams to improve existing cybersecurity measures.
• Contribute to certain functions within the information security framework that ensure confidentiality, integrity, and availability of information assets by protecting against unauthorized use, disclosure, modification, or loss.
• Assist with informing and educating staff about information security, compliance, risks and governance including assisting in phishing prevention campaigns. including monitoring employee training compliance
• Assist in monitoring, administering and enforcing security policies / procedures.
• Review existing documentation of IT controls, business processes, policies, procedures, and management reports for compliance, effectiveness and sustainability.
• Manage remediation plans / corrective actions for any vulnerabilities or compliance failures reported in audits.
• Perform gap analysis to assess compliance with evolving regulatory requirements and duties such as NIST, PCI-DSS, GLBA, CSA, FCRA, Privacy Laws and other frameworks as needed.
• Maintain safety, security, and privacy standards throughout all areas of responsibility.
• Assist in annual Risk Assessments and Business Impact Analysis reviews with management.
• Assist in annual Business Continuity Exercises and Security Incident Response tabletop exercises.
• Participate in Scope Lock meetings for compliance and risk evaluation for proposed code and feature changes to application.
• Provide input to other teams for current audit, compliance, governance and risk mitigation requirements of proposed actions and / or purchases.

Knowledge

Skills

Abilities

Other Essential Requirements