Security Governance & Audit Specialist (FedRAMP)

Location: Mountain View, California, United States; full-time, in-office five days per week.

Annual base salary: $189,000–$244,000 USD, excluding bonus, equity and benefits.

Company

hirify.global provides a digital identity wallet and identity verification services for consumers, government agencies, healthcare organizations and consumer brands, operating against federal authentication standards.

What you will do

• Build the Common Control Framework from 0 to 1, including control structure, ownership, rollout, scope and mappings across SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other frameworks.
• Own FedRAMP 20x mapping, including Key Security Indicators, machine-readable validation, evidence requirements and pass/fail criteria for automation.
• Manage the PSSOP policy, standard and procedure library, including authorship, approvals, versioning, review cycles and traceability.
• Run risk-based exception management, framework intake, gap assessments, remediation planning, applicability reviews and strategic compliance reporting.
• Support AI governance aligned with ISO/IEC 42001 and map AI security controls into the CCF.
• Partner with Audit, Compliance Engineering, Legal, Privacy, Sales and external auditors on audit readiness, evidence, testing, findings, continuous monitoring, GRC requirements and control-owner enablement.

Requirements

• 8+ years of experience in security governance, risk and compliance in SaaS, cloud or enterprise technology.
• Experience building a multi-framework control set from the ground up, including control design, ownership, rollout and mappings across SOC 2, ISO 27001, PCI DSS and FedRAMP.
• Working knowledge of FedRAMP, ideally FedRAMP 20x, including Key Security Indicators, continuous and automated validation, machine-readable evidence such as OSCAL, and differences from the traditional authorization process.
• Experience writing and maintaining policies, standards and procedures and running a risk-based exception process.
• Experience assessing new frameworks such as ISO/IEC 42001, ISO/IEC 27701 or a comparable standard against an existing control set and driving remediation plans.
• Experience supporting SOC 2, ISO 27001 or PCI DSS audits as an auditee or auditor, with knowledge of control testing, sampling, evidence quality and findings management.
• Working knowledge of AWS and common platforms such as GitHub, SSO and CI/CD to assess audit scope and applicability.
• Ability to convert compliance requirements into clear engineering requirements with acceptance criteria.
• Clear writing and communication skills, with the ability to influence Engineering, Legal, Privacy, Sales and auditors without direct authority.

Culture & Benefits

• Full-time, in-office work culture with roles generally based in company offices.
• Medical, dental and vision coverage, health savings account and flexible spending accounts.
• 401(k) with company match, parental leave, unlimited paid time off subject to policy and eight company-wide holidays.
• Life, disability, accident and critical illness insurance, employee assistance and pet insurance.
• Learning and development benefit, wellbeing and childcare discounts, commuter benefits and travel assistance.

Hiring process

• AI tools may be used in parts of the hiring process, subject to candidate AI-use guidelines.
• Employees participate in E-Verify and the company provides reasonable accommodation where required by law.