Principal Security Governance & Audit Specialist

Builds ID.me's Common Control Framework from scratch: one control set written so engineers can implement it, with each control mapped across SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and the company's other certifications. The specialist also owns the policy library, the risk-based exception process, intake and gap assessments for new frameworks such as ISO 42001, ISO 27701 and AIUC-1, FedRAMP 20x mapping, and posture reporting to leadership.

Working with the audit pillar and compliance engineering, the role keeps every control testable, turns findings into updates and writes requirements for automated evidence and OSCAL-based monitoring. It needs eight years in security GRC, experience building a multi-framework control set, FedRAMP knowledge and audit exposure.