Principal Security Governance & Audit Specialist

ID.me•Mountain View, CA

8d•Onsite

About The Position

The Principal Security Governance & Audit Specialist will create ID.me’s Common Control Framework (CCF) and operate the governance processes around it. The role will establish a single set of controls, defined once and mapped to certifications held or pursued, and will own the policy library, exception process, framework intake, strategic reporting, and ongoing updates as standards change. The specialist will also partner closely with Audit & Assurance to ensure controls are testable and supported by evidence, and to incorporate audit results into the CCF. This role is part of a lean team and works with Compliance Engineering, Legal, Privacy, Sales, and external auditors. Responsibilities include mapping FedRAMP 20x requirements to the CCF, defining automation-ready control intent and evidence criteria, managing policy and procedure documents, assessing new frameworks, determining product and service applicability, supporting AI governance, and reporting on compliance posture and certification progress. The role also contributes to audit readiness and support, findings remediation, continuous control monitoring, GRC platform requirements, and control-owner enablement. ID.me describes its culture as full-time and in-office. Unless a posting specifies otherwise, roles are on-site five days per week at an ID.me office in McLean, Virginia; Mountain View, California; New York City; or Tampa, Florida.

Requirements

At least 8 years of experience in security governance, risk, and compliance (GRC) in SaaS, cloud, or enterprise technology.
Experience building a multi-framework controls set from the ground up, including control design, ownership, rollout, and mapping requirements across SOC 2, ISO 27001, PCI DSS, and FedRAMP.
Working knowledge of FedRAMP; ideally, knowledge of FedRAMP 20x, Key Security Indicators, continuous and automated validation, machine-readable evidence such as OSCAL, and differences from the traditional authorization process.
Experience writing and maintaining policies, standards, and procedures, and running a risk-based exception process.
Experience assessing new frameworks against an existing control set and driving remediation plans.
Experience supporting SOC 2, ISO 27001, or PCI DSS audits as an auditee or auditor, with understanding of control testing, sampling, evidence quality, and findings management.
Working knowledge of AWS and common platforms such as GitHub, SSO, and CI/CD sufficient to assess audit scope and requirement applicability.
Ability to translate compliance requirements into clear engineering requirements with acceptance criteria.
Clear writing and communication skills, and ability to influence Engineering, Legal, Privacy, Sales, and auditors without direct authority.

Nice To Haves

Experience with FedRAMP 20x, including Key Security Indicators, continuous and automated validation, and machine-readable evidence such as OSCAL.
Experience assessing ISO/IEC 42001, ISO/IEC 27701, or a comparable standard.

Responsibilities

Build the Common Control Framework from the ground up, including its control structure, ownership model, engineering-ready controls, framework mappings, rollout plan, and ongoing maintenance.
Map controls to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, and other applicable frameworks.
Own the mapping of FedRAMP 20x requirements, including Key Security Indicators and machine-readable validation, into the CCF; define control intent, evidence, pass/fail criteria, and track requirement changes.
Own the policy, standard, and procedure library, including authorship, review cycles, approvals, versioning, and traceability to CCF controls.
Manage the exception process end to end, including risk-based approvals, compensating controls, tracking, expiry, revalidation, and reporting of open and overdue exceptions.
Manage intake for new frameworks, conduct gap assessments against the CCF, map requirements to controls, and establish remediation plans with owners and dates.
Determine requirement applicability to new products, services, and platforms, and record scope and boundaries in the CCF.
Prepare periodic leadership reports on compliance posture, certification progress, and remediation; support certification business cases with Sales and GTM.
Support the AI governance program aligned to ISO/IEC 42001 and map AI security controls into the CCF.
Partner with Audit & Assurance on audit scope, evidence expectations, and test procedures for SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, and Kantara.
Support external audits and quarterly internal audits by responding to auditor queries, clarifying control intent, and maintaining consistent audit representations.
Convert audit findings and observations into CCF updates, policy changes, or exceptions; track remediation to closure and support customer assurance requests.
Work with Audit and Compliance Engineering to define continuous control monitoring and pass criteria so controls remain testable as automation expands.
Provide Compliance Engineering with requirements, user stories, and acceptance criteria for FedRAMP automation, OSCAL-based continuous monitoring, evidence collection, and pipeline guardrails.
Contribute to GRC platform requirements and rollout.
Track CCF coverage, adoption, exception ageing, and audit readiness; support control-owner enablement and roadshows.

Benefits

Comprehensive medical insurance
Dental insurance
Vision insurance
Health savings account
Flexible spending accounts for medical, limited-purpose, dependent-care, and commuter benefits
Basic and voluntary life and AD&D insurance
401(k) with company match
Parental leave
Unlimited paid time off, subject to the PTO policy
Eight company-wide holidays
Short- and long-term disability insurance
Accident and critical illness insurance
Referral bonus policy
Employee assistance program
Pet insurance
Travel assistant program
Wellbeing and childcare discounts
Benefit advocates
Learning and development benefit