Principal Security Governance & Audit Specialist

The role

You will create a Common Control Framework and manage the governance engine around it. You will own the policy library, exception process, and strategic reporting while working with Audit and Compliance Engineering.

What you will do

• Build the Common Control Framework from 0 to 1
• Own FedRAMP 20x requirements mapping into the CCF
• Own the policy, standard and procedure library
• Run the end to end exception management process
• Run intake for new frameworks and perform gap assessments
• Determine which requirements apply to new products and services
• Prepare periodic reports on compliance posture and certification progress
• Support the AI governance program
• Partner with the Audit pillar on scope and evidence expectations
• Support external and internal audits

Required qualifications

• 8+ years in security governance, risk and compliance (GRC) in SaaS, cloud or enterprise technology
• Experience building a multi-framework controls set from the ground up
• Working knowledge of FedRAMP, ideally FedRAMP 20x
• Experience writing and maintaining policies, standards and procedures
• Experience running a risk-based exception process
• Experience assessing new frameworks against an existing control set
• Audit exposure supporting SOC 2, ISO 27001 or PCI DSS audits
• Working knowledge of AWS and common platforms such as GitHub, SSO and CI/CD
• Ability to turn a compliance requirement into a clear engineering requirement

Nice to have

• FedRAMP 20x: Key Security Indicators, continuous and automated validation, and machine-readable evidence (such as OSCAL)

Benefits

• medical, dental, vision
• health savings account
• flexible spending accounts (medical, limited purpose, dependent care, commuter benefit accounts)
• basic and voluntary life and AD&D insurance
• 401(k) with company match
• parental leave
• unlimited paid time off subject to the terms and conditions of the PTO policy
• 8 company wide holidays
• short and long-term disability insurance
• accident and critical illness insurance
• referral bonus policy
• employee assistance program

About the company

IDMe is a digital identity wallet that simplifies how individuals securely prove their identity online. The company serves federal agencies, state government agencies, healthcare organizations, and consumer brands.