Security GRC & Controls Auditor with Continuous Monitoring

United States Digital Space LLC; San Francisco (CA); Hybrid; USD 150,000 - 190,000; Full time

Job summary

United States Digital Space LLC is seeking an experienced professional to own the CCF across all control domains within our Security Audit & Controls team. You will map controls to SOC 2, ISO 27001, HIPAA, and other commitments, and define how evidence is collected and verified.

You will partner with control owners and GRC partners to draft descriptions, monitor effectiveness, drive remediation, and prepare for audits.

Qualifications

• Experience owning a control framework across multiple frameworks (SOC 2, ISO 27001, HIPAA)
• Experience with continuous controls monitoring or automated evidence collection
• Ability to write control descriptions, control activities, and test procedures
• Strong written communication and ability to work with auditors
• Ability to drive remediation with control owners and partners

Responsibilities

• Own the Common Control Framework and mappings to frameworks and commitments
• Draft and validate control descriptions and activities with control owners
• Design and run continuous monitoring of control efficacy
• Verify remediation and steady-state operations with partners
• Map new frameworks onto the CCF and support gap assessments
• Support integrated audits and customer audits readiness
• Evaluate evidence reliability, including AI-generated evidence
• Build with Claude to automate mapping, testing, and monitoring

Skills

IT audit

Security compliance

Controls assurance

Audit mechanics

Written communication

Cross-functional collaboration

Education

Bachelor's degree in related field

Tools

GRC platforms

Job description

United States Digital Space LLC is seeking an experienced professional to own the CCF across all control domains within our Security Audit & Controls team. You will map controls to SOC 2, ISO 27001, HIPAA, and other commitments, and define how evidence is collected and verified.

You will partner with control owners and GRC partners to draft descriptions, monitor effectiveness, drive remediation, and prepare for audits.