Demonstrated experience with recognized security and assurance frameworks such as SOC 2 Type II, ISO 27001/27002, NIST CSF, CIS Controls, COBIT, or equivalent control frameworks, including practical control design, implementation, evidence collection, and remediation tracking. One or more relevant professional certifications is strongly preferred, such as CISSP, CISM, CRISC, CCSP, ISO 27001 Lead Implementer, GIAC security management certifications, or equivalent recognized security, cloud, or risk management certification.