Audit and Assurance Specialist

The Audit and Assurance Specialist is a core member of Lumin Digital's Audit and Assurance team, sitting within the Risk organization. This role is responsible for the design, monitoring, and continuous improvement of security and compliance controls across Lumin's regulatory frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards. The role ensures controls satisfy regulatory and audit requirements while genuinely strengthening Lumin's security posture.

The position executes day-to-day activities across the internal and external audit lifecycle, plays a key role in client and prospect trust initiatives, and is central to Lumin's ability to demonstrate a mature, credible, and continuously improving security program.

Essential Functions and Responsibilities:

• Design, document, and implement security and compliance controls across frameworks like SOC 2, PCI DSS, ISO 27001, and HIPAA, ensuring they strengthen Lumin’s security program beyond mere checkbox compliance.
• Assess the design and operating effectiveness of controls, escalating deficiencies and driving improvements that strengthen security, reduce redundancy, and enable business operations.
• Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with workflows, building trusted working relationships.
• Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation, following established methodologies.
• Maintain dashboards and metrics for leadership visibility into control coverage, maturity, and performance trends, flagging notable shifts or emerging risks.
• Manage the Plan of Action and Milestones (POA&M) process, including issue intake, owner assignment, status tracking, follow-up on overdue items, and verification of remediation closure.
• Serve as a liaison for external audits and assessments, including SOC 2 Type II, PCI DSS, ISO 27001, and HIPAA, managing operational cadence and ensuring alignment on scope and expectations.
• Manage auditor document request lists, coordinate evidence collection across internal teams, and proactively address potential findings before formal auditor review.
• Execute Lumin’s internal audit program by running audit plans, performing test procedures, and producing clear working papers and draft reports.
• Complete and deliver security questionnaires from clients and prospects, including RFPs, due diligence questionnaires, and vendor security assessments.
• Support Lumin’s AI assurance efforts by performing control testing on AI and machine-learning systems, collecting evidence for model risk and data lineage controls, and tracking AI-specific findings.
• Maintain a current library of standardized questionnaire responses, share knowledge with teammates, and participate in client-facing meetings.
• Monitor regulatory and industry framework changes and share recommendations for maintaining compliance expectations.