What you'll do
The Senior Security Compliance Manager is responsible for maintaining and managing new and ongoing Docusign security commercial certification audits and self-assessments.
These include but are not limited to ISO *****, *****, *****, PCI-DSS 4.0, IRAP, APEC PRP, C5, ISMAP, FISC, SIG, and CSA STAR etc.
The Senior Security Compliance Manager will be responsible for building scalable and efficient processes related to supporting the APAC region and overall security compliance programs working closely with the Compliance team in the United States.
The Security Compliance Manager will monitor the security compliance landscape to identify which standards and certifications are relevant for the APAC region of the organization and translate into program actions such as performing gap analysis and remediations.
The successful candidate has the auditing experience, technical expertise, and information security knowledge to plan, execute and deliver on existing and strategic new Security Compliance certifications.
The successful candidate will drive the cross-functional work necessary to ensure the implementation of the management, operational and technical security controls required to be compliant with all applicable regulations and security compliance standards.
They will work in close collaboration with all control owners, Product and Engineering, IT, Security, US Public Sector Compliance, Legal Product and Regulatory Compliance.
This hands-on position will mature relationships with internal control owners and stakeholders globally to represent Docusign Security Compliance programs.
This position is an individual contributor role reporting to the Director, Security Compliance.
Responsibilities
Analyze the security compliance landscape continuously to identify which standards and certifications are relevant for the APAC region and translate requirements into program actions such as performing gap analysis, remediations, and controls effectiveness testing
Lead end-to-end ANZ IRAP technical compliance with external auditors and ANZ government agencies and monitor compliance annually; This includes mapping IRAP controls to cloud-native architectures, automating evidence collection, and embedding IRAP requirements into Docusign security controls framework
Perform security requirements mappings and develop or enhance controls to meet additional requirements; This also includes documentation of Evidence Requirements and Supplemental Guidance to support Security GRC programs and socialize to Control Owners
Maintain technical experience and knowledge in Security Domains such as Logging and Detections, and Configuration Management, Vulnerability Management, and Network Security
Implement the use of technical controls and/or AI across security audit, certification, and compliance activities to streamline processes such as evidence automation
Identify automation opportunities and implement scalable solutions including technical and monitoring controls that integrate seamlessly with systems such as GRC platforms, cloud services, and various ticketing tools
Manage and optimize security compliance audits and assessments including customer audits independently end-to-end while adhering to strict deadlines and maintaining executive level metrics and reporting
Partner with engineering and product teams to embed compliance into the system design, architect, and operationalize technical solutions to reduce audit fatigue and streamline compliance team operations using tooling and AI
Define and publish technical security and compliance requirements and controls guidance utilizing technology and/or AI to empower control owners and obtain actionable commitment from relevant stakeholders
Job Designation
Hybrid: Employee divides their time between in-office and remote work.
Access to an office location is required.
(Frequency: Minimum 2 days per week; may vary by team but will be weekly in-office expectation)
Positions at Docusign are assigned a job designation of either In Office, Hybrid or Remote and are specific to the role/job.
Preferred job designations are not guaranteed when changing positions within Docusign.
Docusign reserves the right to change a position's job designation depending on business needs and as permitted by local law.
What you bring
Basic
Experience with Security Compliance frameworks such as ANZ IRAP, Italy ACN, UK Cyber Essentials, and AI Standards such as ISO***** and NIST AI RMF
Experience in supporting compliance automation
Experience with cloud infrastructure (Azure, AWS, GCP) and SaaS technology
Bachelor's degree in Computer Science, Information Systems, or a related field or equivalent work experience
8+ years of relevant work experience in Security Compliance, Auditing, Assessments or other GRC related experience
2+ years of experience managing security compliance audits and/or customer audits
Experience with the audit lifecycle, testing controls, and writing test scripts in various environments and functions
Experience working with cross functional departments and stakeholders to provide security compliance issues, risks, and recommendations
Industry certification such as CISSP, CISA, CISM, CRISC, ISO***** Lead Auditor, CompTIA Security+, AWS/Azure Security, or equivalent GRC certification
Experience reviewing compliance evidences required for audit
Experience engaging with internal, external, and customer auditors
Preferred
Self-starter with excellent communication, collaborative, and presentation skills
Comfortable working in a fast-paced, dynamic environment, and managing multiple projects concurrently
Ability to coach and prepare technical teams / SMEs for audit interviews
Strong understanding of common compliance and governance frameworks relevant for a fast-paced SaaS organization
Strong networker and natural relationship builder with outstanding communication and influencing skills
Executive level engagement and negotiation skills; Comfortable interacting at all levels from C-suite to technical teams
Strong business acumen and leadership skills
Excellent analytical and problem-solving skills and quantitative approach to solving problems
Strong sense of ownership and goal achievement mindset
Experience with privacy principles and the intent of privacy regulations including GDPR, CCPA, HIPAA, and HITRUST
Wage Transparency
Pay for this position is based on a number of factors including geographic location and may vary depending on job-related knowledge, skills, and experience.
Based on applicable legislation, the below details pay ranges in the following locations:
Washington, Maryland, New Jersey and New York (including NYC metro area): $133,****** - $197,****** base salary
This role is also eligible for the following:
Bonus: Sales personnel are eligible for variable incentive pay dependent on their achievement of pre-established sales goals.
Non-Sales roles are eligible for a company bonus plan, which is calculated as a percentage of eligible wages and dependent on company performance.
Stock: This role is eligible to receive Restricted Stock Units (RSUs).
Global benefits provide options for the following:
Paid Time Off: earned time off, as well as paid company holidays based on region
Paid Parental Leave: take up to six months off with your child after birth, adoption or foster care placement
Full Health Benefits Plans: options for 100% employer paid and minimum employee contribution health plans from day one of employment
Retirement Plans: select retirement and pension programs with potential for employer contributions
Learning and Development: options for coaching, online courses and education reimbursements
Compassionate Care Leave: paid time off following the loss of a loved one and other life-changing events
Equal Opportunity Employer
It's important to us that we build a talented team that is as diverse as our customers and where all employees feel a deep sense of belonging and thrive.
We encourage great talent who bring a range of perspectives to apply for our open positions.
Docusign is an Equal Opportunity Employer and makes hiring decisions based on experience, skill, aptitude and a can-do approach.
We will not discriminate based on race, ethnicity, color, age, sex, religion, national origin, ancestry, pregnancy, sexual orientation, gender identity, gender expression, genetic information, physical or mental disability, registered domestic partner status, caregiver status, marital status, veteran or military status, or any other legally protected category.
EEO Know Your Rights poster
#J-*****-Ljbffr