Lead Specialist, Internal Audit, Controls, Compliance and Risk

Pearson•Durham, NC

About The Position

Pearson Virtual Schools is hiring a senior individual contributor to own audit response and governance, risk, and compliance for its platforms. The role leads the internal audit lifecycle, coordinates SOC 2 Type 1 and Type 2 activities, owns the risk register, and governs the business continuity and disaster recovery program. It establishes evidence, attestation, and documentation standards across service owners; turns findings into tracked remediation; and partners with internal audit, cybersecurity, privacy, risk, and legal. The role operates independently of the operational security team, assuring that the team operates controls and independently verifying and attesting to them. It has a dotted-line relationship to the Lead, Service Operations & Cyber Risk for day-to-day coordination. The position also governs the configuration management database for audit scope, while Solution Architecture operates and maintains it. The role prepares GRC status updates for monthly operations reviews, advises service owners, and coaches peers on governance expectations. It has no direct reports and works with internal and external stakeholders, including external auditors and vendors.

Requirements

At least 5 years of experience in internal audit, controls, compliance, or risk; IT audit or GRC experience is strongly preferred.
Hands-on coordination of SOC 2 or SOX programs, including evidence and attestation management.
Demonstrated ownership of a risk register and the risk-management lifecycle.
Experience governing or supporting business continuity and disaster recovery, including impact analyses, plans, tabletop exercises, and attestation.
A professional qualification is expected or strongly preferred, such as CISA, CIA, CRISC, ACA/ACCA, or CISSP.
Proven ability to challenge peers and leaders and represent the organization to external auditors.
Bachelor's degree in a relevant field.

Nice To Haves

Experience in EdTech, SaaS, regulated, or highly distributed environments.
Familiarity with NIST CSF or ISO 22301.
An advanced degree.

Responsibilities

Lead responses across the internal audit lifecycle, including planning, fieldwork coordination, and review of draft observations, root causes, and risks.
Challenge audit observation and management action plan ownership, wording, and feasibility; draft and submit audit-closure proposals with stakeholder alignment.
Coordinate SOC 2 Type 1 and Type 2 programs, including planning and bringing additional platforms into scope; review evidence and return weak submissions for rework.
Work with partner teams to assign and align resources, identify gaps, and support their closure.
Set evidence, attestation, and documentation standards across services.
Translate findings into structured remediation plans with owners, due dates, and evidence requirements, and track them to closure.
Maintain the audit-action tracker, hold action owners accountable, and challenge weak ownership and unrealistic timelines.
Coordinate audit actions owned by other teams across the organization and keep them visible through closure.
Govern the CMDB for audit scope and keep service ownership and classification accurate; Solution Architecture operates and maintains the CMDB.
Own the risk register, including its quality, ownership, clear write-ups, closure, and escalation of risks beyond tolerance.
Turn access-review and vulnerability gaps into formal risks or audit actions where appropriate.
Govern the business continuity and disaster recovery program, including impact analyses, coverage and gaps, vendor continuity, annual reviews, tabletop exercises, and executive attestation.
Partner with internal audit, cybersecurity, privacy, risk, and legal to close findings and prevent repeat observations.
Prepare audit and GRC status updates for monthly operations reviews, covering open actions, overdue items, blockers, and risks.
Advise service owners and coach peers on governance expectations as an objective assurance partner.