Compliance Controls Manager

WellSky•Overland Park, KS

3d•Onsite

About The Position

The Compliance Controls Manager partners with organizational leaders to provide direction and guidance on WellSky’s compliance programs. The role manages the IT controls matrix mapped across SOC 1, SOC 2, HITRUST CSF, the HIPAA Security Rule, PCI DSS, and NIST CSF, and supports compliance with applicable laws, regulatory requirements, policies, and procedures. The position is based at WellSky’s World Headquarters in Overland Park, Kansas.

Requirements

Bachelor’s degree or equivalent work experience.
At least 4–6 years of experience in technology governance, risk and compliance, IT auditing, or IT risk advisory.
Willingness to work additional or irregular hours as needed.
Work in accordance with applicable security policies and procedures to safeguard company and client information.
Ability to sit and view a computer screen for extended periods.

Nice To Haves

Working knowledge of NIST CSF or NIST 800-53, the HIPAA Security Rule, and HITRUST CSF.
Experience in healthcare technology, SaaS, or another regulated environment handling PHI, testing cloud controls, and identifying platforms.
Industry-leading certifications such as CISA, CISM, CRISC, or CCSFP.
Big Four or public accounting governance, risk, and controls experience.
Strong working knowledge of IT general controls, COSO, and AICPA Trust Services Criteria.
Hands-on experience leading SOC examinations, either from the service organization or auditor side.

Responsibilities

Partner with business and technical owners on system descriptions, scoping, trust service criteria, and the development, implementation, and communication of compliance controls.
Draft, revise, and maintain an inventory of technology compliance policies and procedures in response to changing requirements.
Develop and maintain systems for continuous monitoring and reporting using a GRC platform and automated evidence collection.
Serve as the primary contact for technology compliance initiatives with external auditors, including SOC reports, HITRUST, and PCI DSS.
Lead assurance engagements, including annual SOC 1 Type II and SOC 2 Type II examinations, from scoping through report issuance.
Triage and resolve control exceptions and incident investigations; prepare management action plans and root-cause analyses; and drive corrective action plans to closure.
Perform other job duties as assigned.