Audit & Assurance Specialist - Lumin Digital

Basic Function

The Audit and Assurance Specialist is a core member of Lumin Digital's Audit and Assurance team, sitting within the Risk organization. This role is responsible for the design, monitoring, and continuous improvement of security and compliance controls across Lumin's regulatory frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards.

The Audit and Assurance Analyst approaches control work with a dual mandate: ensuring that controls satisfy regulatory and audit requirements and that they genuinely strengthen Lumin's security posture rather than serving as a compliance checkbox. This position executes day-to-day activities across the internal and external audit lifecycle, plays a key role in client and prospect trust initiatives, and is central to Lumin's ability to demonstrate a mature, credible, and continuously improving security program.

Essential Functions and Responsibilities

• Design, document, and implement security and compliance controls across applicable frameworks, including SOC 2, PCI DSS, ISO 27001, and HIPAA.
• Assess the design and operating effectiveness of controls, escalating deficiencies and exceptions promptly and driving improvements that strengthen security, reduce redundancy, and enable the business.
• Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with standard workflows.
• Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation.
• Maintain dashboards and metrics that give leadership clear visibility into control coverage, maturity, and performance trends.
• Manage the Plan of Action and Milestones (POA&M) process within assigned scope, including issue intake, owner assignment, status tracking, overdue item follow-up, and remediation closure verification.
• Serve as a day-to-day liaison for external audits and assessments (SOC 2 Type II, PCI DSS, ISO 27001, HIPAA), managing audit fieldwork cadence and evidence requests.
• Execute Lumin’s internal audit program by running audit plans, performing test procedures, and producing structured working papers and draft reports.
• Complete security questionnaires from existing clients and prospective customers (RFPs, due diligence questionnaires, vendor security assessments).
• Support Lumin’s AI assurance efforts by performing control testing on AI and machine-learning systems, validating evidence for model risk and data lineage, and tracking AI-specific findings.
• Maintain a library of standardized questionnaire responses and participate in client-facing meetings as needed.
• Monitor regulatory and industry framework changes and share recommendations for maintaining compliance.

Qualifications

Education & Certifications

• Bachelor’s degree in a relevant field (Information Systems, Business, Risk Management) preferred.
• Certifications such as CISA, Security+, or equivalent preferred; CRISC, ISO 27001 Lead Implementer/Auditor are a plus.

Experience

• 4+ years of professional experience in information security, GRC, compliance, IT audit, or a related field required.
• Demonstrated experience designing, evaluating, and improving security controls within a GRC platform (e.g., TrustCloud, OneTrust, Drata) required.
• Experience working in a regulated financial services, fintech, or similarly regulated SaaS environment required.
• Hands-on experience managing or supporting external audits or assessments, including SOC 2 and/or PCI-DSS required (HIPAA preferred).
• Experience with internal audit programs, security questionnaires/RFPs, and POA&M remediation management preferred.
• Experience collaborating across cross-functional technical and non-technical teams.

Knowledge, Skills, & Abilities

• In-depth familiarity with SOC 2, PCI-DSS, ISO 27001, HIPAA, NIST 800-53, and FFIEC IT Examination Handbook standards.
• Strong understanding of control design principles (preventive, detective, corrective controls) in a cloud-native SaaS environment.
• Working knowledge of AI/ML governance and control considerations (model risk, data lineage, third-party AI services).
• Excellent written and verbal communication skills with the ability to convey complex compliance concepts to technical and non-technical stakeholders.
• High attention to detail and strong project coordination capabilities.

Travel

• Minimal travel, generally 12 days or less per year (~2x team get-togethers per year).