• Own and manage OnePlan’s governance, risk, and compliance program across security and privacy frameworks • Maintain the company’s compliance certifications including SOC 2 Type II, ISO 27001, and ISO 27701, ensuring ongoing audit readiness and successful surveillance audits and recertifications • Coordinate with external auditors and manage evidence collection, control validation, and supporting documentation • Maintain and update security policies, procedures, and internal documentation supporting compliance frameworks • Maintain the company risk register and drive risk identification, assessment, and remediation activities across the organization • Partner closely with Engineering and IT teams to implement and document security controls across the platform • Lead OnePlan’s FedRAMP Moderate readiness initiative, including NIST 800-53 gap assessments and remediation planning • Develop and maintain the System Security Plan (SSP) and associated FedRAMP documentation • Prepare the organization for 3PAO assessment and establish processes for ongoing continuous monitoring • Manage vendor risk assessments and third party security reviews • Support enterprise and public sector security questionnaires, compliance reviews, and due diligence requests • Ensure privacy and data protection practices align with GDPR and global privacy frameworks • Support the ongoing operation of OnePlan’s ISO 27701 privacy program