Lead Specialist, Internal Audit, Controls, Compliance and Risk

Overview

This role is a senior individual contributor responsible for audit response and governance, risk, and compliance (GRC) across virtual learning platforms. The position owns response across the internal audit lifecycle, SOC 2 (Types 1 and 2), the risk register, and the business continuity and disaster recovery (BC/DR) program.

The role sits independently of the operational security team, providing independent verification and attestation of controls. It also maintains a dotted-line relationship to the Lead, Service Operations & Cyber Risk for day-to-day coordination.

Responsibilities

Internal Audit & SOC 2 Leadership

• Lead audit response across the internal audit lifecycle, including planning, fieldwork coordination, and review of draft observations, root causes, and risks.
• Challenge observation and management action plan ownership, wording, and feasibility; draft and submit audit-closure proposals with stakeholder alignment.
• Own SOC 2 (Type 1 and Type 2) coordination, including planning and bringing additional platforms into scope.
• Review evidence and return weak submissions for rework.
• Work with partner teams to ensure resources are assigned and aligned; support teams in closing gaps.

Controls, Evidence & Remediation

• Set standards for evidence, attestation, and documentation across services.
• Translate findings into structured remediation plans with owners, due dates, and evidence requirements; track plans to closure.
• Maintain the audit-action tracker and hold action owners accountable by challenging weak ownership and unrealistic timelines.
• Coordinate audit actions owned by other teams and keep them visible to closure.
• Govern configuration management database (CMDB) ownership and classification for audit scope accuracy.

Risk & Resilience Governance

• Own the risk register, including quality, owners, clear write-ups, closure, and escalation of risks beyond tolerance.
• Convert access-review and vulnerability gaps into formal risks or audit actions where appropriate.
• Govern the business continuity and disaster recovery program, including impact analyses, coverage and gaps, vendor continuity, annual reviews, tabletop exercises, and executive attestation.

Cross-Functional Influence & Reporting

• Partner with internal audit, cybersecurity, privacy, risk, and legal teams to close findings and prevent repeat observations.
• Prepare audit and GRC status updates for monthly operations reviews, including open actions, overdue items, blockers, and risks.
• Advise service owners and coach peers on governance expectations, providing objective assurance.

Requirements

• 5 or more years of experience in internal audit, controls, compliance, or risk (IT audit or GRC strongly preferred)
• Hands-on coordination experience with SOC 2 (or SOX) programs, including evidence and attestation management
• Demonstrated ownership of a risk register and the risk-management lifecycle
• Experience governing or supporting business continuity and disaster recovery (impact analyses, plans, tabletops, attestation)
• Professional qualification expected or strongly preferred (CISA, CIA, CRISC, ACA/ACCA, or CISSP)
• Proven ability to challenge peers and leaders and represent the organization to external auditors
• Ability to operate independently, maintain objectivity, and provide professional skepticism

Preferred Qualifications

• Experience in EdTech, SaaS, regulated, or highly distributed environments
• Familiarity with NIST CSF or ISO 22301
• Bachelor’s degree in a relevant field; advanced degree a plus

Compensation & Benefits

• Not specified in the provided description.

Location

• Remote

Work Schedule

• Full-time

Additional Information

• Direct reports: None (senior individual contributor role)
• Equal opportunity employer; employment decisions based on qualifications, merit, and business need
• Member of E-Verify