Audit & Assurance Specialist

The Audit and Assurance Specialist is a core member of Lumin Digital's Audit and Assurance team, sitting within the Risk organization. This role is responsible for the design, monitoring, and continuous improvement of security and compliance controls across Lumin's regulatory frameworks, including SOC 2, PCI DSS, ISO 27001, HIPAA, and other applicable standards. The Audit and Assurance Analyst approaches control work with a dual mandate: ensuring that controls satisfy regulatory and audit requirements and that they genuinely strengthen Lumin's security posture rather than serving as a compliance checkbox.

This position executes day-to-day activities across the internal and external audit lifecycle in accordance with the methodology and standards set by the Lead, Audit & Assurance, plays a key role in client and prospect trust initiatives, and is central to Lumin's ability to demonstrate a mature, credible, and continuously improving security program.

• Design, document, and implement security and compliance controls across applicable frameworks, including SOC 2, PCI DSS, ISO 27001, and HIPAA, applying established practices to ensure controls meaningfully strengthen Lumin’s security program rather than simply meeting checkbox requirements.

• Assess the design and operating effectiveness of controls, escalating deficiencies and exceptions promptly and driving improvements that strengthen security, reduce redundancy, and enable the business.

• Partner with Engineering, Product, Operations, and other teams to ensure controls are practical, enforceable, and aligned with how work gets done, building reliable working relationships and serving as a trusted point of contact for control-related questions.

• Conduct structured control testing through evidence review, system inspection, policy analysis, stakeholder interviews, and configuration validation, following established testing methodology and sampling strategies to assess whether controls function as designed.

• Maintain dashboards and metrics that give leadership clear visibility into control coverage, maturity, and performance trends, and flag notable shifts or emerging risks.

• Manage the Plan of Action and Milestones (POA&M) process within the assigned scope, including issue intake, owner assignment, status tracking, follow-up on overdue items, and verification of remediation closure. Escalate systemic trends and aged items to the Lead, Audit & Assurance for broader remediation oversight.

• Serve as a day-to-day liaison for external audits and assessments, including SOC 2 Type II, PCI DSS, ISO 27001, and HIPAA, managing the operational cadence of audit fieldwork and ensuring alignment on scope, expectations, and timely escalation as needed.

• Manage auditor document request lists, coordinate evidence collection across internal teams, and proactively address potential findings before formal auditor review.

• Execute Lumin’s internal audit program by running audit plans, performing test procedures, applying defined sampling strategies, and producing clear, well-organized working papers and draft reports for Lead review.

• Complete and deliver security questionnaires from existing clients and prospective customers, including RFPs, due diligence questionnaires, and vendor security assessments. Escalate engagements involving regulatory examinations, complex technical scrutiny, or strategic prospect opportunities.

• Support Lumin’s AI assurance efforts by performing control testing on AI and machine-learning systems, collecting and validating evidence for model risk and data lineage controls, completing AI-related questionnaire sections, and tracking AI-specific findings through remediation, in alignment with the…