Security GRC Specialist, Oportun

• The ideal candidate will serve as a subject matter expert in security controls, evidence management, and audit coordination using AuditBoard and Microsoft Office Suite. Experience with FTC Safeguards, SOC 1, or SOX programs is beneficial but not required
• Bachelor’s degree in Information Systems, Cybersecurity, Business, or related field
• 6–8 years of experience in IT audit, security governance, risk, and compliance, or related functions
• Hands-on experience supporting or leading SOC 2 and PCI DSS audits
• Proficiency with AuditBoard, Microsoft Office (Excel, Word, PowerPoint), and collaboration tools
• Strong understanding of information security frameworks (NIST, ISO 27001, AICPA/SOC, PCI DSS, FTC)
• Excellent written and verbal communication skills, with the ability to translate technical topics into business terms
• Proven ability to manage multiple concurrent audits or assurance initiatives in a dynamic environment

Desirable

• The Security GRC Specialist, Audit & Assurance is responsible for leading Oportun’s audit readiness and assurance initiatives across security and compliance programs
• This role will oversee execution and continuous improvement of control frameworks supporting SOC 2, PCI DSS, and partner assurance programs, ensuring alignment with Oportun’s compliance strategy and regulatory expectations
• This role partners closely with internal teams, external auditors, and business stakeholders to maintain a robust and transparent compliance posture
• Lead the planning, coordination, and execution of internal and external audits across SOC 2, PCI DSS, and partner assurance programs
• Maintain Oportun’s control framework within AuditBoard, ensuring timely updates, documentation accuracy, and evidence completeness
• Collaborate with control owners and cross-functional teams to prepare audit artifacts, track remediation activities, and communicate progress to leadership
• Develop and refine audit procedures, evidence collection methodologies, and reporting standards using Microsoft Excel, PowerPoint, and SharePoint
• Support development and maintenance of policies, standards, and procedures aligned to regulatory and industry frameworks (NIST CSF, ISO 27001, AICPA/SOC, PCI DSS)
• Conduct internal readiness assessments and gap analyses to proactively identify compliance risks and improvement opportunities
• Manage auditor and partner requests, providing timely and professional responses
• Serve as a mentor and escalation point for junior GRC analysts
• LEVEL VALIDATION: A7 (Specialist / Lead) Aligned to Oportun’s Professional & Management Global Level Criteria:
• Recognized for specialized depth in GRC and audit frameworks
• Leads complex audit initiatives with limited guidance
• Decisions have cross-functional impact on compliance and risk posture
• Provides guidance and mentorship to junior staff