Security Governance & Audit Specialist at Idme · LumiJobs

Responsibilities

Because governance only works if controls survive an audit, you will also work closely with the Audit & Assurance pillar. You will understand how controls are tested and evidenced, so that what Governance defines is auditable and what Audit finds feeds back into the CCF. You will join a lean team and work with Compliance Engineering, Legal, Privacy, Sales and external auditors.
CORE RESPONSIBILITIES
Common Control Framework. Build the CCF from 0 to 1 (highest priority): define the control structure and ownership model, write one set of engineering-ready controls mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other frameworks, set the rollout plan, and keep it current as standards change.
FedRAMP 20x. Own how FedRAMP 20x requirements, including Key Security Indicators (KSIs) and machine-readable validation, are mapped into the CCF. Define the control intent, evidence and pass/fail criteria that Compliance Engineering automates, and track changes to the 20x requirements.
PSSOP library. Own the policy, standard and procedure library: authorship, review cycles, approvals, versioning and traceability to CCF controls.
Exception management. Run the exception process end to end: risk-based approval, compensating controls, tracking, expiry and revalidation. Report open and overdue exceptions.
Framework intake and regulatory change. Run intake for new frameworks such as ISO/IEC 42001, ISO/IEC 27701 and AIUC-1. Perform gap assessments against the CCF, map requirements to controls, and set remediation plans with owners and dates.
Onboarding and applicability. Determine which requirements apply to new products, services and platforms. Record scope and boundaries once in the CCF.
Strategy and reporting. Prepare periodic reports on compliance posture, certification progress and remediation for leadership. Support certification business cases with Sales and GTM.
AI governance. Support the AI governance program aligned to ISO/IEC 42001, and map AI security controls into the CCF.
ALSO CONTRIBUTE TO (AUDIT & ASSURANCE)
Audit readiness. Partner with the Audit pillar on audit scope, evidence expectations and test procedures for SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and Kantara. Make sure each CCF control can be tested and evidenced.

Security Governance & Audit Specialist

Responsibilities

Benefits

Company

Idme

More roles at Idme