Principal Security Governance & Audit Specialist at ID.me in Mountain View, CA

Job description

Company Overview IDMe is the next-generation digital identity wallet that simplifies how individuals securely prove their identity online. Consumers can verify their identity with IDMe once and seamlessly login across websites without having to create a new login and verify their identity again. Over 175 million users experience streamlined login and identity verification with IDMe at 22 federal agencies, 50 state government agencies, and more than 100 healthcare organizations. Over 600 consumer brands use IDMe to verify communities and user segments to honor service and build more authentic relationships. IDMe’s technology meets the federal standards for consumer authentication set by the Commerce Department and is approved as a NIST 800-63-3 IAL2 / AAL2 credential service provider by the Kantara Initiative. IDMe is committed to “No Identity Left Behind” to enable all people to have a secure digital identity. To learn more, visit https://network.id.me/ . IDMe is a full-time, in-office culture. Unless a specific job description explicitly states otherwise, all roles are on-site five days per week at one of our offices in McLean, VA; Mountain View, CA; New York City, NY; or Tampa, FL. Certain roles — such as field-based sales or other remote-by-design positions — may have different work arrangements as noted in their individual postings. At IDMe, we embrace the thoughtful use of AI tools in our daily work and there are even occasions where we leverage AI in our hiring process. However, during the interview process, we want to understand your individual skills and experiences. Therefore, we have guidelines on how AI can be appropriately used during your application and interviews which can be found here . ABOUT THE ROLE You will create our Common Control Framework (CCF) and run the governance engine around it: one set of controls, defined once and mapped to every certification we hold or pursue. You will own the policy library, exception process, framework intake and strategic reporting, and keep the CCF current as standards change. Because governance only works if controls survive an audit, you will also work closely with the Audit & Assurance pillar. You will understand how controls are tested and evidenced, so that what Governance defines is auditable and what Audit finds feeds back into the CCF. You will join a lean team and work with Compliance Engineering, Legal, Privacy, Sales and external auditors. CORE RESPONSIBILITIES Common Control Framework. Build the CCF from 0 to 1 (highest priority): define the control structure and ownership model, write one set of engineering-ready controls mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other frameworks, set the rollout plan, and keep it current as standards change. FedRAMP 20x. Own how FedRAMP 20x requirements, including Key Security Indicators (KSIs) and machine-readable validation, are mapped into the CCF. Define the control intent, evidence and pass/fail criteria that Compliance Engineering automates, and track changes to the 20x requirements. PSSOP library. Own the policy, standard and procedure library: authorship, review cycles, approvals, versioning and traceability to CCF controls. Exception management. Run the exception process end to end: risk-based approval, compensating controls, tracking, expiry and revalidation. Report open and overdue exceptions. Framework intake and regulatory change. Run intake for new frameworks such as ISO/IEC 42001, ISO/IEC 27701 and AIUC-1. Perform gap assessments against the CCF, map requirements to controls, and set remediation plans with owners and dates. Onboarding and applicability. Determine which requirements apply to new products, services and platforms. Record scope and boundaries once in the CCF. Strategy and reporting. Prepare periodic reports on compliance posture, certification progress and remediation for leadership. Support certification business cases with Sales and GTM. AI governance. Support the AI governance prog