Compliance Controls Manager

WellSky•Overland Park, KS

4d•Onsite

About The Position

The Compliance Controls Manager partners with organizational leaders to provide direction and guidance on WellSky’s compliance programs. The role manages the IT controls matrix across SOC 1, SOC 2, HiTrust CSF, HIPAA Security Rule, PCI DSS, and NIST CSF, and supports compliance with applicable laws, regulatory requirements, policies, and procedures. This position is based at WellSky’s World Headquarters in Overland Park, Kansas. The manager works with business and technical owners on system descriptions, scoping, trust service criteria, and the development, implementation, and communication of compliance controls. The role also maintains technology compliance policies and procedures, supports continuous monitoring and reporting through a GRC platform and automated evidence collection, and serves as the primary contact for technology compliance initiatives with external auditors. The manager leads assurance engagements, including annual SOC 1 Type II and SOC 2 Type II examinations, from scoping through report issuance. The role also triages and resolves control exceptions and incident investigations, prepares management action plans and root cause analyses, and drives corrective actions to closure. Additional duties may be assigned. The position requires additional or irregular hours as needed, adherence to security policies and procedures, and the ability to sit and view a computer screen for extended periods.

Requirements

Bachelor’s degree or equivalent work experience.
At least 4–6 years of experience in technology governance, risk and compliance, IT auditing, or IT Risk Advisory.
Ability to sit and view a computer screen for extended periods.

Nice To Haves

Working knowledge of NIST CSF or NIST 800-53, HIPAA Security Rule, and HiTrust CSF.
Experience in healthcare technology, SaaS, or another regulated environment handling PHI, testing cloud controls, and identifying platforms.
Industry-leading certifications such as CISA, CISM, CRISC, or CCSFP.
Big Four or public accounting governance, risk, and controls experience.
Strong working knowledge of IT general controls, COSO, and AICPA trust services criteria.
Hands-on experience leading SOC examinations, on either the service organization or auditor side.

Responsibilities

Partner with business and technical owners on system descriptions, scoping, trust service criteria, and the development, implementation, and communication of compliance controls.
Draft, revise, and maintain an inventory of technology compliance policies and procedures in line with changing compliance requirements.
Develop and maintain systems for continuous monitoring and reporting using a GRC platform and automated evidence collection.
Serve as the primary contact for technology compliance initiatives with external auditors, including SOC reports, HiTrust, and PCI DSS.
Lead assurance engagements, including annual SOC 1 Type II and SOC 2 Type II examinations, from scoping through report issuance.
Triage and resolve control exceptions and incident investigations; prepare management action plans and root cause analyses; and drive corrective action plans to closure.
Perform other job duties as assigned.
Work additional or irregular hours as needed.
Follow applicable security policies and procedures to safeguard company and client information.