We are looking for an ITSM Compliance Specialist to ensure transparency and reliability of IT processes, conduct internal and external audits, assess risks, and implement effective control measures. The role includes process automation, analytical reporting (Grafana, Tableau), working with ITSM and GRC platforms, and fostering a culture of compliance with ISO, SOC 2, and SOX-ITGC standards.

1. Ensuring that IT processes comply with corporate policies, best practices, and IT frameworks (Incident, Problem, Change, Request, Service Catalog, CMDB):
– developing and maintening the ITGC framework;
– designing and implementing methodologies for IT risk management;
– developing documented IT policies, processes, procedures, and standards;
– maintaining the inventory of SOX in-scope IT systems and infrastructure supporting financial reporting controls
2. Performing regular and ad-hoc IT internal control audits, including:
– evaluating the design of IT controls (Test of Design);
– testing the operating effectiveness of IT controls (Test of Operating Effectiveness);
– reviewing SOC 1 Type 2 reports, defining CUECs, and assessing vendor compliance;
– identifying control gaps and recommending remediation actions;
– performing internal testing of key ITGC controls (Access Management, Change Management, Compute Operations)
3. Assessing the current state of IT controls and developing remediation plans
4. Supporting external IT audits: preparing teams, responding to auditor requests, collecting evidence and samples to validate control effectiveness
5. Monitoring and analyzing ITSM metrics (SLA/SLI/SLO, incident trends, problem backlog, change success rate, CMDB data quality)
6. Preparing weekly and monthly automated reports on ITSM compliance and process maturity
7. Participating in CAB/ECAB: reviewing changes, assessing risk, test plans, and rollback strategies.
8. Driving improvements based on audit results: standards, control checkpoints, automation of control testing
9. Improving compliance culture: conducting workshops, training, and consultations
10. Collaborating with Engineering, SRE, Security, Compliance, Legal, Finance, and other stakeholders
11. Developing and implementing DRP as part of corporate Business Continuity Plans (BCP).