validation, anomaly detection in control performance, natural-language summarization of
audit evidence), partnering with Engineers on complex builds requiring multiple system
integrations, while directly building and implementing automation and AI-driven solutions
for more contained use cases.
•Identify controls that are strong candidates for automation or continuous monitoring based on
testing frequency, evidence type, and data source availability, and build the roadmap to get
•Contribute to the long-term vision for self-service compliance tooling — dashboards or
interfaces that let control owners and stakeholders check their own compliance posture
without waiting on the GRC team.
•Build reusable, scalable testing and automation patterns so the team isn't reinventing the
wheel every time a new framework or regulation comes into scope.
•Work closely with the Governance and Risk teams to ensure the CCF, risk management
program, and governance program are integrated, with aligned control sets, shared evidence,
and coordinated reporting.
•Identify opportunities to harmonize compliance controls with risk appetite and governance
structures, reducing duplication and improving program efficiency.
•Participate in cross-GRC planning sessions to align timelines, control mappings, and
stakeholder engagement strategies across all three programs.
•Support the development and communication of a unified GRC narrative for leadership,
translating program health across risk, governance, and compliance into cohesive insights.
Compliance Assessment & Methodology
•Serve as a subject matter partner to the PCI program owner to ensure CCF controls satisfy
PCI DSS requirements and support the annual PCI assessment process.
•Design and implement enterprise compliance assessment methodologies that integrate
multiple regulatory domains (e.g., NIST, CIS, SOX, HIPAA, CCPA).
•Develop operational standards and quality criteria for compliance processes, ensuring
consistency and effectiveness across the organization, and pushing control testing toward
continuous rather than once-a-year scrambles.
•Serve as a subject matter resource for control testing approaches, evidence collection, and
