• Align organizational controls to NIST CSF 2.0 and other relevant frameworks, translating policies into measurable technical standards and control requirements • Maintain continuous SOC 2 Type II readiness by managing the year-round evidence lifecycle and validating control effectiveness across all Trust Services Criteria using GRC tools • Conduct and support technology and cybersecurity risk assessments across key domains, including IAM, change management, incident response, vulnerability management, logging and monitoring, cloud/SaaS, data protection, endpoint security, and backup/disaster recovery • Monitor control performance and risk telemetry against established thresholds, proactively identifying, escalating, and addressing at-risk controls before critical failure points are reached • Lead corrective action plans (CAPs) for identified gaps, partnering with control owners to drive timely remediation and root cause resolution • Perform risk-based assessments of critical third parties, including SaaS, AI, and cloud providers, evaluating SOC reports and security posture against internal risk standards • Document control design and operating effectiveness, including process narratives, control mappings, and evidence standards • Serve as a liaison for internal and external audits, providing clear, defensible documentation and rationale for control decisions • Develop executive dashboards and reporting that provide visibility into framework alignment, control health, and audit readiness, enabling proactive risk insights for leadership • Collaborate cross-functionally with business and technology teams to embed security and risk standards into products and services and support timely, comprehensive risk reporting to senior leadership • Perform other duties as assigned.