- Design, document, and implement security and compliance controls across applicable frameworks.
- Assess control design and operating effectiveness, escalate deficiencies, and drive improvements.
- Conduct control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation.
- Maintain dashboards and metrics on control coverage, maturity, and performance trends.
- Manage assigned POA&M activities, including issue intake, owner assignment, status tracking, follow-up, and verification of remediation closure.
- Coordinate external audit fieldwork, auditor requests, and evidence collection across internal teams.
- Execute internal audit plans, perform test procedures, and prepare working papers and draft reports.
- Complete client and prospect security questionnaires, RFPs, due diligence questionnaires, and vendor security assessments.
- Perform AI and machine-learning control testing, validate evidence for model risk and data lineage controls, and track findings through remediation.
- Monitor changes to regulations and industry frameworks and share recommendations.
HIPAA