Security Audit & Controls, Security GRC
Core
Own the Common Control Framework (CCF) across all control domains, ensuring controls map to frameworks like SOC 2, ISO 27001, and HIPAA, and drive continuous monitoring of their effectiveness.
Role type
Senior individual contributor security audit and controls engineer
Builds
A canonical set of controls and automated monitoring programs that verify operating effectiveness for auditors and engineers
Domain
Cybersecurity governance, risk, and compliance (GRC)
Required skills
IT audit and controls assurance, framework mapping (SOC 2, ISO 27001, FedRAMP, HIPAA), control description drafting, continuous controls monitoring design, technical fluency in runbooks and pipelines, clear technical writing, stakeholder prioritization
Preferred skills
Common controls framework design, automated evidence collection programs, LLM application to assurance work, AI system controls assessment, homegrown GRC platform requirements
Technologies
SOC 2, ISO 27001, FedRAMP, HIPAA, LLMs, automated evidence collection tools
Responsibilities
Own the Common Control Framework and its mappings to regulatory frameworks; Draft and validate control descriptions and activities with control owners; Design and run continuous monitoring of control efficacy; Verify remediation and standardize evidence pull; Map new frameworks onto the CCF; Support integrated and customer audits; Evaluate evidence reliability including AI-generated evidence
Seniority
Senior, hands-on IC
