Basic Function The Audit and Assurance Specialist is a core member of Lumin Digital's Audit and Assurance team, sitting within the Risk organization. This role is responsible for the design, monitoring, and continuous improvement of security and compliance controls across Lumin's regulatory frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards. The Audit and Assurance Specialist approaches control work with a dual mandate: ensuring that controls satisfy regulatory and audit requirements and that they genuinely strengthen Lumin's security posture rather than serving as a compliance checkbox. This position executes day-to-day activities across the internal and external audit lifecycle in accordance with the methodology and standards set by the Lead, Audit & Assurance, plays a key role in client and prospect trust initiatives, and is central to Lumin's ability to demonstrate a mature, credible, and continuously improving security program. Essential Functions and Responsibilities: • Design, document, and implement security and compliance controls across applicable frameworks, including SOC 2, PCI DSS, ISO 27001, and HIPAA, applying established practices to ensure controls meaningfully strengthen Lumin’s security program rather than simply meeting checkbox requirements. • Assess the design and operating effectiveness of controls, escalating deficiencies and exceptions promptly and driving improvements that strengthen security, reduce redundancy, and enable the business. • Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with how work gets done, building reliable working relationships and serving as a trusted point of contact for control-related questions. • Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation, following established testing methodology and sampling strategies to assess whether controls function as designed. • Maintain dashboards and metrics that give leadership clear visibility into control coverage, maturity, and performance trends, and flag notable shifts or emerging risks. • Manage the Plan of Action and Milestones (POA&M) process within the assigned scope, including issue intake, owner assignment, status tracking, follow-up on overdue items, and verification of remediation closure. Escalate systemic trends and aged items to the Lead, Audit & Assurance for broader remediation oversight. • Serve as a day-to-day liaison for external audits and assessments, including SOC 2 Type II, PCI DSS, ISO 27001, and HIPAA, managing the operational cadence of audit fieldwork and ensuring alignment on scope, expectations, and timely escalation as needed. • Manage auditor document request lists, coordinate evidence collection across internal teams, and proactively address potential findings before formal auditor review. • Execute Lumin’s internal audit program by running audit plans, performing test procedures, applying defined sampling strategies, and producing clear, well-organized working papers and draft reports for Lead review. • Complete and deliver security questionnaires from existing clients and prospective customers, including RFPs, due diligence questionnaires, and vendor security assessments. Escalate engagements involving regulatory examinations, complex technical scrutiny, or strategic prospect opportunities. • Support Lumin’s AI assurance efforts by performing control testing on AI and machine-learning systems, collecting and validating evidence for model risk and data lineage controls, completing AI-related questionnaire sections, and tracking AI-specific findings through remediation, in alignment with the internal audit methodology. • Maintain a current library of standardized questionnaire responses, share knowledge with teammates on common requests and lessons learned, and participate in client-facing meetings as needed to support Lumin’s security program. • Monitor regulatory and industry framework changes and share recommendations for maintaining compliance expectations. • Perform other duties as assigned. Physical Demands: • While performing the duties of this Job, the employee is regularly required to sit; use hands to type, handle, or feel; and talk or hear • Specific vision abilities required by this job include close vision • Ability to occasionally lift/move up to 25 pounds • Individuals with a disability who are otherwise able to perform the essential functions of the job may request reasonable accommodation through the Human Resources department. Supervisory Responsibility: • None. Position Specifications Education: • Bachelor’s degree in a relevant field, such as Information Systems, Business, or Risk Management, preferred. • Certifications such as CISA, Security+, or equivalent are preferred; CRISC, ISO 27001 Lead Implementer/Auditor are a plus. Experience: • Four (4) or more years of professional experience in information security, GRC, compliance, IT audit, or a related field required. • Demonstrated experience designing, evaluating, and improving security controls within a GRC platform (e.g., TrustCloud, OneTrust, Drata, or similar) is required. • Experience working in a regulated financial services, fintech, or similarly regulated SaaS environment required. • Hands-on experience managing or supporting external audits or assessments, including SOC 2 and/or PCI-DSS, required. Experience supporting HIPAA assessments preferred. • Experience developing or contributing to an internal audit program, including audit planning, test execution, and formal reporting preferred. • Experience completing security questionnaires, RFPs, or vendor due diligence requests in a client-facing or pre-sales context preferred. • Experience managing POA&M processes, tracking remediation activities, and reporting on issue status to leadership preferred. • Experience coordinating across