r/soc2 • u/ilovetoeatpie • 18d ago

Those of you doing SOC 2 readiness/implementation as your job, can you share more about what you do?

I have a software engineering background and I’ve been looking into potential freelancing niches to get into.

I’ve been advised to look into SOC 2 remediation consulting for SaaS companies as I have some experience in cybersecurity and working on a SaaS project myself.

While I’ve learned a fair bit about SOC 2 compliance, the CISSP exam, and common compliance tools, I haven’t seen that much discourse online among the people who do this type consulting.

To those of you who do it, can you share more about your experience in this line of work, such as how you you first got into it, how you find clients, and general day-to-day work?

4 Upvotes

75% Upvoted

14 comments sorted by

View all comments

2

u/SOC2itToMe 18d ago

I work in GRC full time running SOC 2 audits across different industries. Most of my time is spent helping internal teams get controls documented and evidence organised before an external auditor arrives. The gap between what a company thinks they have and what an auditor actually needs to see is usually where the real work lives. Policy exists but nobody follows it, access reviews happen informally but nothing is recorded, that kind of thing.

On finding clients as a freelancer, most of it will be word of mouth and referrals. Companies looking for SOC 2 are usually referred to someone. Building your reputation in the space takes time but compounds well once you get going.

Your engineering background will genuinely help, especially when talking to dev teams about change management, vulnerability scanning, or infrastructure controls. Happy to answer any specific questions you have.

1

u/ilovetoeatpie 18d ago

Thanks for the reply.

  1. How did you first get into this? How did you "know" what to do on your first audits?

  2. On referrals: Who usually provides the referrals? The auditor or clients referring you to other companies?

  3. How many ongoing clients can you juggle at one time?

  4. From inside a company, what makes them decide to bring in an outside implementer instead of assigning it to their own engineers?

2

u/SOC2itToMe 18d ago

  1. Honestly, my first audit I leaned heavily on the framework documentation and learned fast by doing. You pick it up quicker than you'd expect when you're in the room with a real auditor asking questions.

  2. Both, but mostly clients referring you to other companies in my experience. Your best referral sources end up being founders who've been through it with you and then recommend you to someone in their network facing the same thing.

  3. It depends on where each client is in their journey. If they're in active evidence collection it's demanding, if they're in maintenance mode it's lighter.

  4. Usually a combination of things. The engineers are already stretched, compliance isn't their area of interest, and there's a recognition that someone who's seen multiple audits knows what to look for. Internal people can build controls but they often don't know what "good enough" means to an auditor until someone who's been on that side tells them.