Controls Specialist, Security GRC

Job summary

Responsibilities

As part of the Security Audit & Controls team, you will own the CCF across every control domain, from access and change management to logging, encryption, and people controls: which controls we have, what each one says, how each maps to the frameworks and commitments we hold, and whether each one…

• Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding…
• Draft and validate control descriptions and control activities with control owners, so each control states who does what, how often, in which system, and what evidence proves it
• Design and run continuous monitoring of control efficacy: define the metrics and automated tests that show operating effectiveness, tune out false positives, surface failures to…
• Verify remediation and carry it into steady state: GRC Partners lead remediation in their domains and control owners implement the fixes.
• Map new frameworks and commitments onto the CCF as we commit to them, and support gap assessments when a new framework, certification, product, or entity comes into scope, using…

What they're looking for

• Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or control library across more than one framework (for…
• Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability
• Experience writing control descriptions, control activities, and test procedures that other teams and external auditors relied on
• Experience with continuous controls monitoring or automated evidence collection, whether you built it, ran it, or audited it
• Enough technical fluency to read a runbook, a configuration, or a pipeline definition and judge whether it enforces what the written control claims