Security Governance & Audit Specialist

Company Overview

ID.me is the next-generation digital identity wallet that simplifies how individuals securely prove their identity online. Consumers can verify their identity with ID.me once and seamlessly login across websites without having to create a new login and verify their identity again. Over 175 million users experience streamlined login and identity verification with ID.me at 22 federal agencies, 50 state government agencies, and more than 100 healthcare organizations. Over 600 consumer brands use ID.me to verify communities and user segments to honor service and build more authentic relationships. ID.me’s technology meets the federal standards for consumer authentication set by the Commerce Department and is approved as a NIST 800-63-3 IAL2 / AAL2 credential service provider by the Kantara Initiative. ID.me is committed to “No Identity Left Behind” to enable all people to have a secure digital identity. To learn more, visit network.id.me ↗ .

ID.me is a full-time, in-office culture. Unless a specific job description explicitly states otherwise, all roles are on-site five days per week at one of our offices in McLean, VA; Mountain View, CA; New York City, NY; or Tampa, FL. Certain roles — such as field-based sales or other remote-by-design positions — may have different work arrangements as noted in their individual postings.

At ID.me, we embrace the thoughtful use of AI tools in our daily work and there are even occasions where we leverage AI in our hiring process. However, during the interview process, we want to understand your individual skills and experiences. Therefore, we have guidelines on how AI can be appropriately used during your application and interviews which can be found here .

ABOUT THE ROLE

You will create our Common Control Framework (CCF) and run the governance engine around it: one set of controls, defined once and mapped to every certification we hold or pursue. You will own the policy library, exception process, framework intake and strategic reporting, and keep the CCF current as standards change.

Because governance only works if controls survive an audit, you will also work closely with the Audit & Assurance pillar. You will understand how controls are tested and evidenced, so that what Governance defines is auditable and what Audit finds feeds back into the CCF. You will join a lean team and work with Compliance Engineering, Legal, Privacy, Sales and external auditors.

CORE RESPONSIBILITIES

• Common Control Framework. Build the CCF from 0 to 1 (highest priority): define the control structure and ownership model, write one set of engineering-ready controls mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other frameworks, set the rollout plan, and keep it current as standards change.

• FedRAMP 20x. Own how FedRAMP 20x requirements, including Key Security Indicators (KSIs) and machine-readable validation, are mapped into the CCF. Define the control intent, evidence and pass/fail criteria that Compliance Engineering automates, and track changes to the 20x requirements.

• PSSOP library. Own the policy, standard and procedure library: authorship, review cycles, approvals, versioning and traceability to CCF controls.

• Exception management. Run the exception process end to end: risk-based approval, compensating controls, tracking, expiry and revalidation. Report open and overdue exceptions.

• Framework intake and regulatory change. Run intake for new frameworks such as ISO/IEC 42001, ISO/IEC 27701 and AIUC-1. Perform gap assessments against the CCF, map requirements to controls, and set remediation plans with owners and dates.

• Onboarding and applicability. Determine which requirements apply to new products, services and platforms. Record scope and boundaries once in the CCF.

• Strategy and reporting. Prepare periodic reports on compliance posture, certification progress and remediation for leadership. Support certification business cases with Sales and GTM.

• AI governance. Support the AI governance program aligned to ISO/IEC 42001, and map AI security controls into the CCF.

ALSO CONTRIBUTE TO (AUDIT & ASSURANCE)

• Audit readiness. Partner with the Audit pillar on audit scope, evidence expectations and test procedures for SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and Kantara. Make sure each CCF control can be tested and evidenced.

• Audit support. Support external audits and quarterly internal audits: respond to auditor queries, clarify control intent and interpretation, and keep audit representations consistent with the CCF.

• Findings and remediation. Turn audit findings and observations into CCF updates, policy changes or exceptions. Track remediation to closure and support customer assurance requests.

• Continuous control monitoring. Work with Audit and Compliance Engineering to define what is monitored and what counts as passing, so the CCF stays testable as automation grows.

• Compliance Engineering. Give engineers clear requirements, user stories and acceptance criteria for FedRAMP automation, OSCAL-based ConMon, evidence collection and pipeline guardrails. Contribute to GRC platform requirements and rollout.

• Metrics and enablement. Track CCF coverage, adoption, exception ageing and audit readiness, and support control-owner enablement and roadshows.

WHAT YOU WILL BRING

• 8+ years in security governance, risk and compliance (GRC) in SaaS, cloud or enterprise technology.

• Experience building a multi-framework controls set from the ground up, including control design, ownership and rollout, and mapping requirements to controls across SOC 2, ISO 27001, PCI DSS, FedRAMP.

• Working knowledge of FedRAMP, ideally FedRAMP 20x: Key Security Indicators, continuous and automated validation, and machine-readable evidence (such as OSCAL), and how these differ from the traditional authorization process.

• Experience writing and maintaining policies, standards and procedures, and running a risk-based exception process.

• Experience assessing new frameworks (such as ISO/IEC 42001, ISO/IEC 27701 or a comparable standard) against an existing control set, and driving remediation plans.

• Audit exposure: you have supported SOC 2, ISO 27001 or PCI DSS audits as an auditee or auditor, and understand control testing, sampling, evidence quality and findings management.

• Working knowledge of AWS and common platforms such as GitHub, SSO and CI/CD, enough to judge audit scope and which requirements apply.

• Ability to turn a compliance requirement into a clear engineering requirement with acceptance criteria.

• Clear writing and communication, and the ability to influence Engineering, Legal, Privacy, Sales and auditors without direct authority.

HOW SUCCESS IS MEASURED

• 90 days: PSSOP library and exceptions baselined; CCF design, structure, scope and ownership model agreed; audit calendar, scope and evidence expectations understood; first periodic report delivered.

• 6 months: CCF v1 built and baselined, including FedRAMP 20x mapping and automation criteria agreed with Compliance Engineering; first gap assessments (ISO/IEC 42001, ISO/IEC 27701, AIUC-1) delivered with remediation plans; exception process running with tracked expiry; audit findings feeding CCF updates; control requirements handed to Compliance Engineering.

• 12 months: A repeatable intake process for every new framework; CCF adopted across engineering and mappings current for all certifications; audits supported with no repeat findings from the CCF; regular reporting on coverage, exceptions and audit readiness.

WHY THIS ROLE

You will sit at the point where controls are defined and proven: shaping one framework that serves every certification, while learning how it holds up in audit and automation.

The annual base salary listed does not include a company bonus, incentive for sales roles, equity and benefits which will be determined based on experience, skills, education, relevant training, geogr