Audit & Assurance Specialist

Lumin Digital•Madison, MS

5d•$105,000 - $125,000

About The Position

The Audit & Assurance Specialist is a core member of Lumin Digital’s Audit and Assurance team within the Risk organization. The role designs, monitors, and continually improves security and compliance controls across frameworks including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards. It is responsible for ensuring controls meet audit and regulatory requirements while genuinely strengthening Lumin’s security posture. The specialist executes day-to-day activities across internal and external audit lifecycles in line with the methodology and standards set by the Lead, Audit & Assurance. The position also supports client and prospect trust initiatives, contributes to AI assurance, and helps demonstrate a mature and continuously improving security program. It works closely with technical and non-technical teams, external auditors, clients, and prospects, and manages assigned control testing, audit coordination, questionnaires, remediation tracking, and related reporting.

Requirements

Four or more years of professional experience in information security, GRC, compliance, IT audit, or a related field.
Demonstrated experience designing, evaluating, and improving security controls within a GRC platform such as TrustCloud, OneTrust, Drata, or a similar platform.
Experience working in regulated financial services, fintech, or a similarly regulated SaaS environment.
Hands-on experience managing or supporting external audits or assessments, including SOC 2 and/or PCI DSS.
Experience coordinating across technical and non-technical teams in a fast-paced, deadline-driven environment.
Deep familiarity with security and compliance frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, NIST 800-53, and FFIEC IT Examination Handbook expectations.
Strong understanding of control design principles, including preventive, detective, and corrective controls, and how to make controls compliant and operationally effective.
Ability to assess control applicability and effectiveness in a SaaS environment, with an understanding of cloud infrastructure, application security concepts, and shared responsibility models.
Strong project coordination and organizational skills to manage concurrent audit engagements, questionnaire requests, and monitoring workstreams accurately.
Excellent written and verbal communication skills, including the ability to explain complex security and compliance concepts to technical and non-technical audiences, executives, and external auditors.
Ability to develop and maintain program-level dashboards and reporting on compliance program health.
Critical thinking, strong attention to detail, and a proactive approach to identifying risks, gaps, and improvement opportunities.
Comfort engaging professionally and credibly with external auditors, clients, and prospects.
Ability to design and improve security workflows within GRC platforms, including control configuration, evidence workflows, and applicable test automation.
Working knowledge of AI/ML governance and control considerations, including model risk, data lineage, prompt and output handling, and third-party AI services, sufficient to independently execute related testing, evidence, and questionnaire work.
Self-directed, able to work with a high degree of independence while remaining aligned with team priorities and leadership direction.

Nice To Haves

Bachelor’s degree in a relevant field such as Information Systems, Business, or Risk Management.
Certifications such as CISA, Security+, or equivalent; CRISC or ISO 27001 Lead Implementer/Auditor certifications are a plus.
Experience supporting HIPAA assessments.
Experience developing or contributing to an internal audit program, including audit planning, test execution, and formal reporting.
Experience completing security questionnaires, RFPs, or vendor due diligence requests in a client-facing or pre-sales context.
Experience managing POA&M processes, tracking remediation activities, and reporting issue status to leadership.

Responsibilities

Design, document, implement, assess, and improve security and compliance controls across applicable frameworks.
Assess control design and operating effectiveness, escalate deficiencies and exceptions, and drive remediation and improvements.
Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with business operations.
Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation.
Maintain dashboards and metrics that show control coverage, maturity, performance trends, and emerging risks.
Manage the assigned scope of the Plan of Action and Milestones (POA&M) process, including intake, owner assignment, status tracking, overdue-item follow-up, and remediation-closure verification; escalate systemic trends and aged items to the Lead, Audit & Assurance.
Serve as a day-to-day liaison for external audits and assessments, managing fieldwork cadence and alignment on scope, expectations, and escalation.
Manage auditor document request lists, coordinate evidence collection, and proactively address potential findings.
Execute the internal audit program by running audit plans, performing test procedures, applying sampling strategies, and preparing working papers and draft reports for Lead review.
Complete security questionnaires for existing clients and prospective customers, including RFPs, due diligence questionnaires, and vendor security assessments; escalate complex or strategic engagements as appropriate.
Support AI assurance by testing controls for AI and machine-learning systems, validating model-risk and data-lineage evidence, completing AI questionnaire sections, and tracking findings through remediation.
Maintain standardized questionnaire responses, share knowledge with teammates, and participate in client-facing meetings as needed.
Monitor regulatory and industry framework changes and recommend updates to compliance expectations.
Perform other duties as assigned.