Role: Specialist – Audit Management (PCI, SOC and ISO 27001)

About the Company:

Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency, enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T, you won’t just imagine the future-you’ll create it.

About the Job:

The Technology Risk Management team is part of Chief Security Office (CSO) and responsible for managing multiple teams that facilitate external audits, internal audits, analyze policy exceptions, conduct risk assessments, and run enforceable governance across processes. They work closely with the AT&T Technology Services (ATS) teams, Cyber Security Risk Management (CSRM) teams and other CSO teams to ensure effective and efficient GRC processes. Below are the key responsibilities of the Specialist – Audit Management position:

• Develop and maintain comprehensive internal and external audit plans, including PCI DSS audits, ensuring scope, objectives, deliverables, activities, owners, timelines, and dependencies are clearly defined, assigned, tracked, and completed in a timely manner.
• Maintain end-to-end audit process documentation and process flows for internal and external audits, ensuring procedures, roles, responsibilities, and supporting documentation remain current and clearly defined.
• Lead the annual Control Owner Assertion (COA) process, ensuring completion at least six weeks before the start of the internal audit cycle (SOC), and drive readiness activities with Data and Control Owners.
• Develop and facilitate audit kick-off activities, including presentations, timelines, communication protocols, expectations, and audit-request templates; finalize materials at least two weeks before kick-off and ensure external auditor requests are clearly documented in advance.
• Facilitate PCI DSS audits end to end, coordinating audit readiness, evidence and documentation requests, control-owner engagement, interviews, walkthroughs, testing support, auditor inquiries, fieldwork, and remediation activities to support successful completion of the PCI DSS assessment.
• Serve as the primary coordination point between external auditors and internal Data and Control Owners, scheduling interviews, walkthroughs, onsite and remote fieldwork, and working sessions while ensuring auditors receive appropriate access, evidence, clarification, and support.
• Manage inquiries, clarification requests, and follow-ups from both auditors and internal stakeholders throughout the audit lifecycle, while ensuring the confidentiality and integrity of sensitive audit information.
• Review preliminary audit findings and reports, coordinate responses with appropriate Data and Control Owners, and track resulting action items through timely remediation and validation of closure.
• Provide weekly and monthly audit status reporting covering overall audit health, outstanding requests, issues, risks, and actions; conduct recurring status meetings and working sessions to drive resolution of open audit items.
• Drive continuous improvement and audit readiness through research and analysis, staff education, Data Owner training, and post-audit reviews that identify lessons learned, compliance gaps, required remediation, accountable owners, and improvement opportunities.

 

Experience Level: 5+ years.

Location: Hyderabad / Bengaluru

Required skills:

• 3 years minimum experience in conducting IT audits, Risk assessments, information security compliance, or IT security operations.
• A minimum of 2 years’ experience leading ISO 27001, SOC, PCI audits
• Strong understanding of cybersecurity frameworks and standards (e.g., NIST, ISO 27001, CIS Controls).
• Excellent project management, organizational, and communication skills.

Desirable skills:

• Prior experience with Telecom sector.
• Relevant certifications such as ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CRISC, or CISA

Understanding and Application of AI

• Familiarity with applying Artificial Intelligence (AI) or Machine Learning (ML) techniques in cybersecurity contexts
• Experience leveraging AI-enabled tools (such as Copilot for Security, Darktrace, CrowdStrike Charlotte AI, or custom LLM integrations) to enhance detection, response, automation workflows.
• Understanding of LLM safety, prompt engineering, or AI governance frameworks (e.g., NIST AI and RMF, EU AI Act readiness) is a plus.
•  Exposure to data science fundamentals relevant to security (pattern recognition, supervised vs. unsupervised learning, model validation).
• Awareness of AI-driven risks (e.g., adversarial ML, data poisoning, model hallucination) and their mitigation within enterprise environments.

Additional information (if any): Need to be flexible to provide coverage in US morning hours.

Weekly Hours:

40

Time Type:

Regular

Location:

Bengaluru, India, Hyderabad, India

AT&T and its subsidiaries are committed to equal employment opportunity. All hiring, promotion, and other employment decisions remain merit-based and free from discrimination on the basis of race, color, religion, religious creed, national origin, ancestry, age, sex, sexual orientation, gender, gender identity, gender expression, physical disability, mental disability, pregnancy, medical condition, genetic information, marital status, citizenship status, military status, veteran status, or any other characteristic protected by federal, state, or local laws. In addition, AT&T will provide reasonable accommodations to qualified individuals with disabilities. AT&T is a fair chance employer and does not initiate a background check until an offer is made. Click here to learn more or request an application accommodation here.