What are the responsibilities and job description for the Staff Security Assurance Controls Manager position at ID.me?
Company Overview
ID.me is the next-generation digital identity wallet that simplifies how individuals securely prove their identity online. Consumers can verify their identity with ID.me once and seamlessly login across websites without having to create a new login and verify their identity again. Over 152 million users experience streamlined login and identity verification with ID.me at 20 federal agencies, 45 state government agencies, and 70 healthcare organizations. More than 600 consumer brands use ID.me to verify communities and user segments to honor service and build more authentic relationships. ID.me's technology meets the federal standards for consumer authentication set by the Commerce Department and is approved as a NIST 800-63-3 IAL2 / AAL2 credential service provider by the Kantara Initiative. ID.me is committed to "No Identity Left Behind" to enable all people to have a secure digital identity. To learn more, visit https://network.id.me/.
Role Overview
ID.me is seeking a Staff Security Assurance Controls Manager to lead the development, implementation, and ongoing operation of our internal control program for external security and privacy frameworks including FedRAMP, ISO 27001, and SOC 2.
This role is critical to maintaining the trust of our customers and regulatory stakeholders by ensuring that security and compliance requirements are met across ID.me's rapidly evolving product and infrastructure landscape. You will work cross-functionally with Engineering, Product, Security, GRC, and external auditors to design scalable control strategies, validate control effectiveness, and operationalize continuous monitoring.
This role is based out of our Mountain View, CA office and requires full-time in-office attendance.
Key Responsibilities
- Framework Ownership: Serve as the day-to-day owner for one or more frameworks (e.g., NIST 800-63, FedRAMP, ISO 27001, SOC 2), ensuring alignment between framework requirements and internal controls.
- Control Lifecycle Management: Collaborate with control owners to design, implement, document, and monitor controls. Define control objectives, implementation guidance, and assurance requirements.
- Audit & Assessment Readiness: Coordinate internal and external audits by developing audit plans, preparing walkthroughs, and managing evidence collection activities.
- Continuous Monitoring: Maintain a recurring schedule of control validations based on framework-specific frequency requirements (e.g., FedRAMP ConMon). Track control health and remediation actions.
- Gap Analysis & Risk Assessments: Lead gap analyses between new framework requirements and existing control coverage. Facilitate Security Impact Assessments (SIAs) to assess compliance implications of changes and identify risks.
- Compliance Documentation: Manage organizational policies. Ensure up-to-date, reviewer-approved documentation exists for policies, procedures, and implementation statements. Lead annual reviews and updates.
- Control Remediation & POA&M Management: Partner with control owners to define corrective actions, manage Plans of Action & Milestones (POA&Ms), and track resolution through closure. Propose and coordinate the design of controls to mitigate risks.
- Stakeholder Engagement: Act as a trusted partner to engineering, product, infrastructure, and customer-facing teams. Provide clear guidance on what controls are required, why, and how to satisfy them.
- Tooling & Metrics: Support the use of GRC and data pipelines to automate evidence collection, track control status, and generate metrics for reporting.
- Internal and External: Contribute to executive and board-level reporting, as well as external customer reporting such as through Continuous Monitoring reports.
Basic Qualifications
- Bachelor's degree in Information Security, Computer Science, Engineering, Risk Management, or related field—or equivalent practical experience.
- 7–10 years of experience managing and operating security/compliance programs, including at least one of: FedRAMP, ISO 27001, or SOC 2.
- 3–5 years of experience managing third-party audits (e.g., ATO, SOC, ISO certs), including evidence preparation, auditor interface, and corrective actions.
- Proficient in project management: planning, tracking, reporting, and issue resolution.
- Strong understanding of security control domains (e.g., access control, vulnerability management, encryption, logging, change management).
- Experience working in cloud-native environments (AWS, GCP preferred). Familiarity with GRC platforms such as LogicGate, ServiceNow GRC, or Archer.
Preferred Qualifications
- NIST 800-63 experience with identity proofing and authenticator management is preferred
- Experience leading or contributing to FedRAMP Continuous Monitoring (ConMon) activities or significant change requests (SCR) / change management.
- Policy, plan, procedure management.
- Deep understanding of control implementation across cloud-native and DevOps environments.
- CISSP, CISA, CCSK, or ISO 27001 Lead Auditor certification.
- Cloud security certifications (e.g., GCP, AWS, etc.) are a plus.
- Experience working in SaaS or regulated environments (e.g., healthcare, finance, government).
#LI-JS1
ID.me is a full-time, in-office culture. Unless a specific job description explicitly states otherwise, all roles are on-site five days per week at one of our offices in McLean, VA; Mountain View, CA; New York City, NY; or Tampa, FL. Certain roles — such as field-based sales or other remote-by-design positions — may have different work arrangements as noted in their individual postings.
ID.me maintains a work environment free from discrimination, where employees are treated with dignity and respect. All ID.me employees share in the responsibility for fulfilling our commitment to equal employment opportunity. ID.me does not discriminate against any employee or applicant on the basis of age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable laws, regulations and ordinances. ID.me adheres to these principles in all aspects of employment, including recruitment, hiring, training, compensation, promotion, benefits, social and recreational programs, and discipline. In addition, ID.me's policy is to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations and ordinances where a particular employee works. Upon request we will provide you with more information about such accommodations.
Please review our Privacy Policy, including our CCPA policy, at id.me/privacy. If you provide ID.me with any personally identifiable information you confirm that you have read and agree to be bound by the terms and conditions set out in our Privacy Policy.
ID.me participates in E-Verify.