Security Governance & Audit Specialist

ID.me•Mountain View, CA

9d•$189,000 - $244,000•Onsite

About The Position

ID.me is hiring a Security Governance & Audit Specialist to build and operate its Common Control Framework (CCF), establishing one set of controls mapped to the certifications and frameworks the company holds or pursues. The role owns the policy, standard and procedure library; exception management; framework intake; applicability assessments; and strategic compliance reporting. It also keeps the CCF current as standards and requirements change. The specialist will work closely with Audit & Assurance to ensure CCF controls can be tested and evidenced, and to incorporate audit findings into the framework. The role partners with Compliance Engineering, Legal, Privacy, Sales, external auditors and other teams. Key work includes mapping FedRAMP 20x requirements—including Key Security Indicators and machine-readable validation—into the CCF, defining automation criteria, supporting AI governance aligned to ISO/IEC 42001, and enabling continuous control monitoring and audit readiness. ID.me describes its culture as full-time and in-office. Unless a posting specifies otherwise, employees work on-site five days per week at an office in McLean, Virginia; Mountain View, California; New York City; or Tampa, Florida. The position offers a base salary range of $189,000–$244,000 USD, with final compensation determined by qualifications, experience, skills, education, training, location and other job-related factors. The stated range does not include any company bonus, sales incentive, equity or benefits.

Requirements

At least 8 years of experience in security governance, risk and compliance (GRC) in SaaS, cloud or enterprise technology.
Experience building a multi-framework control set from the ground up, including control design, ownership and rollout, and mapping requirements across SOC 2, ISO 27001, PCI DSS and FedRAMP.
Working knowledge of FedRAMP; ideally experience with FedRAMP 20x, Key Security Indicators, continuous and automated validation, and machine-readable evidence such as OSCAL, including differences from the traditional authorization process.
Experience writing and maintaining policies, standards and procedures, and operating a risk-based exception process.
Experience assessing new frameworks, such as ISO/IEC 42001 or ISO/IEC 27701, against an existing control set and driving remediation plans.
Experience supporting SOC 2, ISO 27001 or PCI DSS audits as an auditee or auditor, with understanding of control testing, sampling, evidence quality and findings management.
Working knowledge of AWS and common platforms such as GitHub, SSO and CI/CD sufficient to assess audit scope and requirement applicability.
Ability to translate compliance requirements into clear engineering requirements with acceptance criteria.
Clear writing and communication skills, and ability to influence Engineering, Legal, Privacy, Sales and auditors without direct authority.

Nice To Haves

Experience with FedRAMP 20x.
Experience with ISO/IEC 42001, ISO/IEC 27701 or comparable standards.
Experience with OSCAL-based or other machine-readable evidence and continuous or automated validation.

Responsibilities

Build the Common Control Framework from the ground up, defining its structure, control ownership model, engineering-ready controls, mappings, rollout plan and maintenance process.
Map CCF controls to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other relevant frameworks.
Map FedRAMP 20x requirements, including Key Security Indicators and machine-readable validation, into the CCF; define control intent, evidence and pass/fail criteria for automation, and track changes to requirements.
Own the policy, standard and procedure library, including authorship, review cycles, approvals, versioning and traceability to CCF controls.
Operate the exception process end to end, including risk-based approvals, compensating controls, tracking, expiry, revalidation, and reporting on open and overdue exceptions.
Manage intake for new frameworks, assess gaps against the CCF, map requirements to controls, and establish remediation plans with owners and dates.
Determine requirement applicability for new products, services and platforms, and record scope and boundaries in the CCF.
Prepare periodic leadership reports on compliance posture, certification progress and remediation; support certification business cases with Sales and go-to-market teams.
Support the AI governance program aligned to ISO/IEC 42001 and map AI security controls into the CCF.
Partner with Audit & Assurance on audit scope, evidence expectations and test procedures for SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and Kantara; ensure each CCF control can be tested and evidenced.
Support external audits and quarterly internal audits by responding to auditor queries, clarifying control intent and interpretation, and keeping audit representations consistent with the CCF.
Translate audit findings and observations into CCF updates, policy changes or exceptions; track remediation to closure and support customer assurance requests.
Work with Audit and Compliance Engineering to define continuous control monitoring and passing criteria so controls remain testable as automation grows.
Provide engineers with requirements, user stories and acceptance criteria for FedRAMP automation, OSCAL-based continuous monitoring, evidence collection and pipeline guardrails; contribute to GRC platform requirements and rollout.
Track CCF coverage, adoption, exception ageing and audit readiness, and support control-owner enablement and roadshows.
Meet role milestones: baseline the policy and procedure library and exceptions and deliver an initial report within 90 days; build and baseline CCF v1 and deliver initial framework gap assessments within six months; establish repeatable intake, broad engineering adoption, current certification mappings and regular reporting within 12 months.

Benefits

Comprehensive medical insurance
Dental insurance
Vision insurance
Health savings account
Flexible spending accounts for medical, limited-purpose, dependent-care and commuter benefits
Basic and voluntary life and AD&D insurance
401(k) with company match
Parental leave
Unlimited paid time off, subject to the PTO policy
Eight company-wide holidays
Short- and long-term disability insurance
Accident and critical illness insurance
Referral bonus policy
Employee assistance program
Pet insurance
Travel assistance program
Wellbeing and childcare discounts
Benefit advocates
Learning and development benefit