Basic FunctionThe Audit and Assurance Specialist is a core member of Lumin Digital's Audit and Assurance team, sitting within the Risk organization. This role is responsible for the design, monitoring, and continuous improvement of security and compliance controls across Lumin's regulatory frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards. The Audit and Assurance Analyst approaches control work with a dual mandate: ensuring that controls satisfy regulatory and audit requirements and that they genuinely strengthen Lumin's security posture rather than serving as a compliance checkbox. This position executes day-to-day activities across the internal and external audit lifecycle in accordance with the methodology and standards set by the Lead, Audit & Assurance, plays a key role in client and prospect trust initiatives, and is central to Lumin's ability to demonstrate a mature, credible, and continuously improving security program.
Essential Functions and Responsibilities:- Design, document, and implement security and compliance controls across applicable frameworks, including SOC 2, PCI DSS, ISO 27001, and HIPAA, applying established practices to ensure controls meaningfully strengthen Lumin's security program rather than simply meeting checkbox requirements.
- Assess the design and operating effectiveness of controls, escalating deficiencies and exceptions promptly and driving improvements that strengthen security, reduce redundancy, and enable the business.
- Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with how work gets done, building reliable working relationships and serving as a trusted point of contact for control-related questions.
- Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation, following established testing methodology and sampling strategies to assess whether controls function as designed.
- Maintain dashboards and metrics that give leadership clear visibility into control coverage, maturity, and performance trends, and flag notable shifts or emerging risks.
- Manage the Plan of Action and Milestones (POA&M) process within the assigned scope, including issue intake, owner assignment, status tracking, follow-up on overdue items, and verification of remediation closure. Escalate systemic trends and aged items to the Lead, Audit & Assurance for broader remediation oversight.
- Serve as a day-to-day liaison for external audits and assessments, including SOC 2 Type II, PCI DSS, ISO 27001, and HIPAA, managing the operational cadence of audit fieldwork and ensuring alignment on scope, expectations, and timely escalation as needed.
- Manage auditor document request lists, coordinate evidence collection across internal teams, and proactively address potential findings before formal auditor review.
- Execute Lumin's internal audit program by running audit plans, performing test procedures, applying defined sampling strategies, and producing clear, well-organized working papers and draft reports for Lead review.
- Complete and deliver security questionnaires from existing clients and prospective customers, including RFPs, due diligence questionnaires, and vendor security assessments. Escalate engagements involving regulatory examinations, complex technical scrutiny, or strategic prospect opportunities.
- Support Lumin's AI assurance efforts by performing control testing on AI and machine-learning systems, collecting and validating evidence for model risk and data lineage controls, completing AI-related questionnaire sections, and tracking AI-specific findings through remediation, in alignment with the internal audit methodology.
- Maintain a current library of standardized questionnaire responses, share knowledge with teammates on common requests and lessons learned, and participate in client-facing meetings as needed to support Lumin's security program.
- Monitor regulatory and industry framework changes and share recommendations for maintaining compliance expectations.
- Perform other duties as assigned.
Physical Demands:- While performing the duties of this Job, the employee is regularly required to sit; use hands to type, handle, or feel; and talk or hear
- Specific vision abilities required by this job include close vision
- Ability to occasionally lift/move up to 25 pounds
- Individuals with a disability who are otherwise able to perform the essential functions of the job may request reasonable accommodation through the Human Resources department.
Supervisory Responsibility:Position SpecificationsEducation:- Bachelor's degree in a relevant field, such as Information Systems, Business, or Risk Management, preferred.
- Certifications such as CISA, Security+, or equivalent are preferred; CRISC, ISO 27001 Lead Implementer/Auditor are a plus.
Experience:- Four (4) or more years of professional experience in information security, GRC, compliance, IT audit, or a related field required.
- Demonstrated experience designing, evaluating, and improving security controls within a GRC platform (e.g., TrustCloud, OneTrust, Drata, or similar) is required.
- Experience working in a regulated financial services, fintech, or similarly regulated SaaS environment required.
- Hands-on experience managing or supporting external audits or assessments, including SOC 2 and/or PCI-DSS, required. Experience supporting HIPAA assessments preferred.
- Experience developing or contributing to an internal audit program, including audit planning, test execution, and formal reporting preferred.
- Experience completing security questionnaires, RFPs, or vendor due diligence requests in a client-facing or pre-sales context preferred.
- Experience managing POA&M processes, tracking remediation activities, and reporting on issue status to leadership preferred.
- Experience coordinating across cross-functional technical and non-technical teams in a fast-paced, deadline-driven environment is required.
Knowledge, Skills, & Abilities:- Deep familiarity with security and compliance frameworks, including SOC 2, PCI-DSS, ISO 27001, HIPAA, NIST 800-53, FFIEC IT Examination Handbook expectations, and related standards.
- Strong understanding of control design principles, including the distinction between preventive, detective, and corrective controls, and how to design controls that are both compliant and operationally effective.
- Ability to assess control applicability and effectiveness in a SaaS environment, with an understanding of cloud infrastructure, application security concepts, and shared responsibility models.
- Strong project coordination and organizational skills, with the ability to manage multiple concurrent audit engagements, questionnaire requests, and monitoring work-streams without losing accuracy or quality.
- Excellent written and verbal communication skills, with the ability to translate complex security and compliance concepts for both technical and non-technical audiences, including executives and external auditors.
- Ability to build and maintain program-level dashboards and reporting that give leadership clear, current visibility into the health of the compliance program.
- Critical thinker with strong attention to detail and a proactive approach to identifying risks, gaps, and opportunities for improvement before they become findings.
- Comfortable engaging directly with external auditors, clients, and prospects in a professional and credible manner.
- Ability to design and improve security workflows within GRC platforms, including control configuration, evidence workflows, and test automation where applicable.
- Working knowledge of AI/ML governance and control considerations - including model risk, data lineage, prompt and output handling, and third-party AI services - sufficient to independently execute AI-related testing, evidence, and questionnaire work.
- Self-directed and capable of operating with a high degree of independence while maintaining alignment with team priorities and leadership direction.
Travel:- Minimal, generally 12 days or less per year, ~2X team get-togethers a year
Benefits include: We take care of our people with medical, dental, and vision insurance, a 401(k) with company match, flexible PTO plus 12 paid holidays, paid sick leave, and paid parental and family leave. We also offer a lifestyle spending account, tuition reimbursement, and a cell phone stipend. Additional details are provided during the interview process.
