IT Compliance Automation Engineer

• Design and implement workflow-based control automation for Regulatory Standards (e.g., ISO, PCI) and SOX 404 ITGCs, using:
  • Explicit start-action-evidence-end flows.
  • Triggers from tickets, change-management systems, HR events, or IAM changes.
  • Delivered via tools such as n8n, Camunda, Azure Logic Apps, or custom MCP-style servers.
• Build and operate MCP-style or MCP-compatible servers that expose:
  • Tools: RESTful endpoints for “trigger evidence collection”, “run access review”, “validate change ticket”, etc..
  • Resources: Standardized data sources (logs, IAM, ticket data) formatted for AI agents or workflow engines.
  • Auth patterns: API keys, bearer tokens, OAuth2, or OIDC-style flows that can be consumed by agents or external tools.
• Engineer API-first automation:
  • Write scripts and connectors (Python, Node.js, Bash, etc.) that call, compose, and orchestrate APIs from:
    • IAM, IdP, PAM, HRIS, ticketing, cloud IAM, and logging platforms, etc.
    • GRC platforms (e.g., ServiceNow, 6clicks, or similar) via REST APIs.
  • Implement:
    • Authentication and authorization (API keys, Bearer, OAuth2, JWT, Basic, MTLS).
    • Pagination, retry with backoff, rate-limiting, and safe error handling.
    • Idempotency and safe state transitions for audit-critical operations.
• Translate ISO 27001 controls and SOX 404 ITGCs into automated workflows:
  • Example pattern:
    • Trigger: new user join or role change in IAM.
    • Action: call APIs to validate entitlements, cross-check against SoD, and emit evidence to a GRC tool.
    • Outcome: workflow-generated record for ISO 27001 access control and SOX logical-access control.
  • Maintain one source of truth for control logic (code / config) and use workflow IDs as control-evidence bindings.
• Design AI-agent-ready interfaces:
  • Expose structured, MCP-style endpoints or OpenAPI specs so that LLM agents or workflow tools can call concrete tools (e.g., “get latest access review for System X”, “run change-ticket-completeness check”).
  • Handle dynamic policy enforcement: short-lived tokens, context-aware access, and audit logging for each AI or agent call.
• Integrate with data platforms and SIEM/logging:
  • Use logs, change tickets, and identity events as workflow inputs.
  • Build automated tests for control effectiveness (e.g., “if a production change is not approved, fire an alert and record as control failure”) linked to ISO / SOX control IDs.
• Maintain audit-ready workflow artifacts:
  • Log all workflow steps, including timestamps, input, user/agent context, and outputs.
  • Ensure workflow outputs are machinable (JSON, structured logs) and can be replayed or reasoned over by auditors or AI agents.

• Bachelor's degree or above in computer science, computer engineering or related disciplines.
• Strong understanding of authorization and authentication:
  • API keys, Bearer tokens, OAuth2 (client, JWT, PKCE), Basic Auth, MTLS, and OIDC-style flows.
  • Hands-on experience implementing these in Python, Node.js, or Go (or similar).
• Deep practical experience with:
  • RESTful APIs: understanding of HTTP methods, status codes, pagination, rate-limiting, and idempotency.
  • API clients: writing or using libraries that handle auth, retries, and error handling for large datasets.
• Experience building or integrating with:
  • Workflow / orchestration tools (n8n, Airflow, Logic Apps, Camunda, etc.) or MCP-style servers / Model Context Protocol-compatible tooling.
  • GRC platforms via APIs (e.g., ServiceNow, 6clicks, or similar).
• At least 2 years of working experience with:
  • ISO 27001 (especially Annex A controls related to access management, change control, and operations).
  • SOX 404 ITGCs (logical access, change management, computer operations, data integrity).

Familiarity with:

• OpenAPI / Swagger to MCP-style tool generation (e.g., converting production APIs into MCP servers or AI-agent tools).
• Experience with MCP servers or similar control-plane architectures that expose tools, resources, and prompts for AI agents.
• Background in security automation, CI/CD, or DevSecOps (number of tools: n8n, Terraform, Ansible, Docker, logging pipelines).
• Prior involvement in SOX 404 audits and ISO 27001 certification projects, with a focus on how to automate evidence collection rather than manual spreadsheets.