Senior Lead Cyber Compliance

Labcorp•Durham, NC

7d•Hybrid

About The Position

This role is responsible for leading and coordinating cybersecurity compliance assessments and audit readiness activities across multiple regulatory and industry frameworks, including SOC 2 Type II, ISO 27001, NIST 800-53, PCI DSS, SOX ITGC, FedRAMP, and CMMC. The position ensures the successful execution of external audits and assessments by managing workplans, milestones, dependencies, and stakeholder engagement while maintaining audit-ready documentation, and evidence repositories. Working closely with control owners and business partners, the role validates control effectiveness, supports assessment preparedness, and drives timely remediation of identified gaps. As a highly independent contributor, this position plays a critical role in helping Labcorp meet compliance obligations, strengthen its security governance posture, and maintain confidence with customers, regulators, and external assessors.

Requirements

Bachelor’s Degree.
5 or more years of experience supporting cybersecurity compliance assessments and audits aligned to one or more of the following: SOC Type 2, ISO 27001, NIST SP 800-53, FedRAMP, PCI DSS, SOX ITGCs, and CMMC.
5 or more years of experience coordinating audit evidence and testing with multiple control-owner teams (e.g. security, Engineering, IT, Product, Finance).

Nice To Haves

5 or more years with operating in post-acquisition or high-change environments with complex stakeholder landscapes.
5 or more years of experience supporting CMMC readiness and/or working with defense-sector security requirements (e.g. SSP/POA&M development, control implementation tracking).
Independent execution and ownership mindset; proactive identification and removal of blockers.
Compliance tooling (GRC platforms, ticketing systems, evidence repositories, workflow automation tools).
Risk-based prioritization and sound judgment.
Experience using AI-enabled tools to improve efficiency and quality in compliance workflows (e.g., drafting policies/procedures, summarizing evidence sets, accelerating RFI responses, mapping controls, identifying gaps).
Ability to apply AI responsibly in accordance with confidentiality, data handling, and audit defensibility requirements.
Process discipline and attention to detail; strong documentation rigor.
Stakeholder management and clear, concise communication across multiple organizational levels.
Should be open to travel up to 15% on occasion to assist with on-site audits if needed.
Comfortable working within formal governance, change control, and fixed assessment/audit timelines.

Responsibilities

Enable strategic alignment and rationalization across SOC2 Type 2, ISO 27001, NIST SP 800-53, PCI DSS, SOX ITGCs, FedRAMP, and CMMC (and related customer/regulatory requirements) to avoid duplicative effort and an unsustainable annual workload.
Support transitions between assurance approaches where appropriate (e.g., simplifying overlapping requirements) to meet expectations such as state and sector requirements (including TX-RAMP where applicable).
Perform control mapping activities; identifying overlaps, gaps, and efficiency opportunities across standards, internal policies, and contractual obligations.
Preserve consistent, high-quality evidence production for assessments, customer RFIs, and regulatory requirements—reducing execution risk and downstream disruption.
Build and maintain a well-governed evidence repository with clear traceability, version control, retention, and audit defensibility aligned to enterprise standards.
Coordinate timely, accurate responses to customer security questionnaires and assurance requests in partnership with control owners.
Maintain effective operational risk management coverage, ensure monitoring, documentation, and issue lifecycle management continue without erosion as scope expands.
Track findings, exceptions, risks, and remediation activities; coordinate validation and closure documentation aligned to governance expectations.
Support risk reporting and governance cadence (e.g., risk forums, control owner check-ins) with clear status, trends, and escalation points.
Mitigate concentration and continuity risk within compliance/GRC by reducing reliance on a single overextended resource for critical audit and risk functions through documentation, process standardization, and repeatable operating routines.
Develop scalable compliance artifacts (templates, checklists, playbooks) to improve consistency and reduce rework across cycles.
Sustain audit readiness and customer confidence during increased compliance demands and post-acquisition integration complexity.
Serve as a primary compliance partner to control owners across Security, Engineering, IT, Legal, and Operations to drive timely evidence production and remediation outcomes.
Communicate status, risks, and blockers with precision; independently manage stakeholder follow-ups and escalate issues appropriately to protect timelines and quality.
Promote a strong culture of compliance through clear guidance, practical enablement, and consistent expectations for evidence quality.