Security Governance & Audit Specialist
ID.me · Mountain View, California, United States
About this role
**Security Governance & Audit Specialist** **Company Overview** ID.me is a next-generation digital identity wallet that helps individuals securely prove their identity online. With 175M+ users and adoption across federal agencies, state agencies, and healthcare organizations, ID.me supports streamlined login and identity verification. The platform aligns with federal standards for consumer authentication and is approved as a NIST 800-63-3 IAL2 / AAL2 credential service provider. **About the Role** You will create and run ID.me’s **Common Control Framework (CCF)**—defining one set of controls that maps to every certification the company holds or pursues. You’ll own the **policy library**, **exception process**, **framework intake**, and **strategic reporting**, and keep the CCF current as standards evolve. Because governance must hold up in audits, you’ll partner closely with **Audit & Assurance** to ensure controls are **testable and evidenced**, and that audit results feed back into continuous improvements to the CCF. **Core Responsibilities** - **Common Control Framework (CCF)**: Build the CCF from 0→1, define control structure and ownership, write engineering-ready controls mapped to **SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP**, and more; set rollout plans and keep it updated. - **FedRAMP 20x**: Own mapping of FedRAMP 20x requirements (including **Key Security Indicators (KSIs)** and machine-readable validation) into the CCF; define control intent, evidence, and pass/fail criteria; track requirement changes. - **PSSOP Library**: Own policy/standard/procedure library including authorship, review cycles, approvals, versioning, and traceability to CCF controls. - **Exception Management**: Run end-to-end risk-based exception approvals, compensating controls, tracking, expiry, revalidation, and reporting of open/overdue exceptions. - **Framework Intake & Regulatory Change**: Intake new frameworks (e.g., **ISO/IEC 42001, ISO/IEC 27701, AIUC-1**), perform gap assessments, map requirements to controls, and drive remediation plans. - **Onboarding & Applicability**: Determine which requirements apply to new products/services/platforms and record scope/boundaries in the CCF. - **Strategy & Reporting**: Produce periodic reports on compliance posture, certification progress, and remediation; support certification business cases with Sales/GTM. - **AI Governance**: Support AI governance aligned to **ISO/IEC 42001** and map AI security controls into the CCF. **Also Contribute To (Audit & Assurance)** - **Audit Readiness**: Partner on audit scope, evidence expectations, and test procedures across **SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, and Kantara**; ensure each CCF control can be tested and evidenced. - **Audit Support**: Support external and internal audits by responding to auditor questions, clarifying control intent, and keeping representations consistent with the CCF. - **Findings & Remediation**: Convert findings into CCF updates, policy changes, or exceptions; track remediation to closure and support customer assurance requests. - **Continuous Control Monitoring**: Define what is monitored and what counts as passing as automation grows. - **Compliance Engineering Collaboration**: Provide clear requirements, user stories, acceptance criteria for FedRAMP automation, OSCAL-based ConMon, evidence collection, and pipeline guardrails; contribute to GRC platform requirements. - **Metrics & Enablement**: Track coverage, adoption, exception
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.