Security Audit & Controls, Security GRC

📋 Description

• Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO
• Draft and validate control descriptions and control activities with control owners, so each control
• Design and run continuous monitoring of control efficacy: define the metrics and automated tests
• Verify remediation and carry it into steady state: GRC Partners lead remediation in their domains
• Map new frameworks and commitments onto the CCF as we commit to them, and support gap assessments
• Support the integrated audit and customer audits: readiness checks, walkthrough preparation

🎯 Requirements

• Several years in IT audit, security compliance, or controls assurance, including hands-on ownership
• Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating
• Experience writing control descriptions, control activities, and test procedures that other teams
• Experience with continuous controls monitoring or automated evidence collection, whether you built
• Enough technical fluency to read a runbook, a configuration, or a pipeline definition and judge
• Clear writing, because your control language and status reports are what auditors, engineers, and

🎁 Benefits

• Competitive compensation and benefits
• Optional equity donation matching
• Generous vacation and parental leave
• Flexible working hours
• A lovely office space in which to collaborate with colleagues