Senior Security GRC Manager, SOC 2 Compliance

at  Spotify

Security
Spotify is seeking a Senior Security Governance, Risk, and Compliance (GRC) Manager to join the Security Studio who will work closely with our engineering teams and audit functions. You’ll be focused on handling the execution of tasks for the Security GRC Program within Spotify, primarily in relation to driving SOC 2 compliance, but also to other compliance and information security frameworks. You will work on ensuring tasks deliver high-quality value and are completed in a timely fashion. Additionally, you will play an integral part in recommending process improvements and in helping to implement these updates. This role will require a deep understanding of SOC 2 compliance, information security practices, as well as experience in working with technology teams.
Location
New York
Job type
Permanent

What You’ll Do

• Lead the SOC 2 compliance program and large-scale SOC 2 projects, identify dependencies, define success metrics and achievements, and ensure timely delivery
• Design, implement, monitor and maintain SOC 2 controls, while collaborating and building relationships with internal and external business partners
• Lead and handle all stages of SOC 2 audits, ensuring successful completion.
• Resolve appropriate scope of SOC 2 audits, encompassing new and existing service offerings, their supporting infrastructure, and associated processes.
• Lead and respond to customer security questionnaires while collaborating with internal teams, and drive questionnaire response automation
• Identify, assess, and advise on information security risks, processes and controls to a variety of business partners

Who You Are

• You have 5+ years of experience with SOC 2 compliance, including leading a SOC 2 compliance program, controls design, and implementation. Experience in the technology industry is preferred.
• You have 5+ years of experience with security frameworks, e.g. SOC 2, ISO27001, NIST CSF, PCI-DSS, etc., security controls design and implementation, and security best practices
• Prior IT Audit experience in areas of SOC 2, ITGC, SOX are preferred
• CISA, CISM, CISSP or other related certifications are preferred but not required.
• You have experience with privacy frameworks, such as GDPR or CCPA
• You are a strong collaborator, with experience working on teams composed of both technical and non-technical members
• You have a demonstrated ability to lead large projects, problem-solve, multitask, and have excellent organizational skills
• You have excellent written and verbal communication skills, with experience presenting to key stakeholders and partnering with internal collaborators and external auditors
• You thrive in a data-driven, fast-paced and innovative environment

Where You’ll Be

• For this role you will be in New York.

Our global benefits
Extensive learning opportunities, through our dedicated team, GreenHouse.
Flexible share incentives letting you choose how you share in our success.
Global parental leave, six months off - fully paid - for all new parents.
All The Feels, our employee assistance program and self-care hub.
Flexible public holidays, swap days off according to your values and beliefs.
Learn about life at Spotify
The United States base range for this position is $153,693 - $192,116 plus equity. The benefits available for this position include health insurance, six month paid parental leave, 401(k) retirement plan, monthly meal allowance, 23 paid days off, 13 paid flexible holidays. These ranges may be modified in the future

• Lead the SOC 2 compliance program and large-scale SOC 2 projects, identify dependencies, define success metrics and achievements, and ensure timely delivery
• Design, implement, monitor and maintain SOC 2 controls, while collaborating and building relationships with internal and external business partners
• Lead and handle all stages of SOC 2 audits, ensuring successful completion.
• Resolve appropriate scope of SOC 2 audits, encompassing new and existing service offerings, their supporting infrastructure, and associated processes.
• Lead and respond to customer security questionnaires while collaborating with internal teams, and drive questionnaire response automation
• Identify, assess, and advise on information security risks, processes and controls to a variety of business partner