Role & responsibilities :

As a Compliance Specialist II within Security Compliance, you will be a key contributor to Akamai's security compliance posture by leading hands-on control testing, risk identification, and audit management.

Specific responsibilities include :

- Controls Testing & Assessment : Execute design and operating effectiveness testing for technical, physical, and operational security controls across primary frameworks such as SOC 2, ISO 27001, and PCI DSS.

- Evidence Collection & Walkthroughs : Coordinate sampling populations, lead technical walkthroughs with Engineering, DevOps, and IT system owners, and review technical evidence.

- Deficiency Analysis & Remediation : Identify control gaps, document exception trends in our GRC platform, and partner with system owners to draft actionable remediation plans and track them to closure.

- Third-Party Audit Support : Serve as a controls liaison during external audits, managing evidence pipelines, helping explain technical control implementations to auditors, and minimizing business disruption.

- Process Optimization : Partner with engineering teams to transition manual control testing toward continuous control monitoring using GRC tooling and automation.

Preferred candidate profile :

Applicants must meet one of the following education and experience requirements :

- 4 years of relevant experience and a Bachelors degree or

- Equivalent and, or relevant professional experience

Qualifications :

- 4+ years of hands-on experience evaluating or testing security controls against industry standards, with a strong emphasis on SOC 2, ISO 27001, or PCI DSS.

- Working knowledge of core technical security controls (e.g., Identity & Access Management, Change Management, Vulnerability Management, and Logging/Monitoring).

- Strong analytical, problem-solving, and written/verbal communication skills.

- Relevant security or audit certifications (e.g., CISA, CRISC, Security+, CISM, or ISO Lead Auditor) preferred but not required.

- Experience working with cloud infrastructure, containerized environments, or distributed systems preferred but not required.