Sr. IT Compliance Analyst

Quanta Philippines ROHQ is the regional operating headquarters of Quanta Services, Inc. located in Manila, Philippines. The ROHQ supports Quanta's international expansion by sourcing and developing highly qualified workforce for Quanta companies in the US, Australia and worldwide. We are wholly owned by Quanta Services Inc., a New York Stock Exchange listed company (NYSE: PWR)

POSITION OVERVIEW:

The Sr. IT Compliance Analyst (ITRA) reports to the ITRA Manager and supports the IT Risk and Assurance team, with a focus on ISO and SOC audit support and contracts review. The Sr. IT Compliance Analyst is responsible for compliance with Regulations such as Sarbanes-Oxley (SOX), CCPA/CPRA (Data Privacy), Payment Card Industry (PCI), cyber contractual requirements, SOC 2 Trust Framework, ISO 27002, etc., and internal IT policies and controls. This position will assist with the performance of control assessments across various IT General Control (ITGC) areas while working with technical and business stakeholders to select, deploy, and validate IT controls to ensure compliance requirements are maintained. Compliance reviews could consist of ITGCs as well as selected application or special project reviews. Reviews can also cover areas such as application controls, logical access controls for applications, operating systems and databases, backup and recovery procedures, change controls, pre and post-deployment assessments, user administration, perimeter security, and selected configuration management controls.

Duties and Responsibilities

CORE JOB SKILLS/DUTIES:

• Supports the ITRA team's ISO, SOC, and contracts review activities on a limited basis, as directed by the ITRA Manager.

• Completes individual assignments or leads teams in initiatives as assigned by the ITRA Manager.

• Review access controls and user access permissions for all systems and data repositories used in the process. Provide an analysis based on controls to determine if the permissions are appropriate and identify any necessary changes.

• Test the effectiveness of IT controls by performing extensive data reconciliation of documents using Microsoft Excel or similar tools.

• Enter data accurately and efficiently into databases, spreadsheets, or other systems. Verify and review data for errors or inconsistencies.

• Stays up to date on changes to technology, internal policy and standards, and relevant regulatory programs, and evaluates potential impacts on the risk and controls and suggests modifications to IT control framework.

• Assist with large and/or multiple projects and be able to multitask.

• Works with the manager and other team members to identify opportunities for improvement or gaps in existing processes.

• Adheres to internal standards, policies, and procedures.

• Performs other duties as assigned.

Experience in one or more of the following areas is desired:

SOC 2/ISO 27002 Audit/Support

• Understand AICPA trust service criteria controls to support SOC 2 and ISO 27002 audits by maintaining documentation for monitoring controls.

• Assist with oversight functions to collect evidence for monitoring and validation of controls from stakeholders. Review the evidence collected and provide feedback on the effective maintenance of controls.

• Maintain and update the control framework to ensure it aligns with changes in technology and processes, and validate it periodically.

• Set up and maintain an audit schedule. Prepare data requests based on the controls that need to be tested, create requests for stakeholders for evidence, or run reports where access is available. Provide information to the audit team and coordinate follow-up questions.

CONTRACTS REVIEW

• Review customer and vendor contracts for IT, cyber security, and data privacy requirements, and document the obligations that apply.

• Map contractual requirements to existing controls and policies, identify gaps, and raise them with the ITRA Manager and control owners.

Maintain a tracker of contractual obligations, review status, and renewal or amendment dates.

• Coordinate with legal, procurement, and IT stakeholders to clarify requirements and collect evidence of compliance.

EDUCATION AND EXPERIENCE:

Required Education and Experience

• Bachelor's degree in MIS, Information Systems, Computer Science, Engineering or related field

• 5 to 7 years of relevant experience in areas listed above or expertise in areas such as IT Compliance, IT Audit, IT Security, etc.

• Sufficient knowledge of information technology and data management systems

• Working knowledge of standards and framework such as NIST (CSF, SP 800-53), CIS Controls, ISO, SOC, ITL, COBIT, PCI-DSS, and other security frameworks

• Familiarity with or experience using Vanta or similar compliance automation and GRC platforms

• Ability to read and interpret contractual IT and security requirements

• Proficiency in data analysis with a focus on accuracy and precision

• Proficiency in typing and data entry skills with high accuracy

• Proficiency in Microsoft Office (Word, Excel, & PowerPoint) and other productivity tools

• Ability to manage large datasets and perform basic data manipulations

• Ability to work independently and in a team environment

• Amenable to working US hours (CST, Night Shift)

Preferred Licenses/Certifications

• CISA, CIA, CPA, CISM, CISSP, MCP, MCSE, CCNA, CompTIA– at least 1 certification required or other applicable for the job certifications are desired but not required.