Senior InfoSec Risk & Compliance Specialist

IDEXX's Information Security Team is dedicated to safeguarding the organization against various cyber risks and ensuring compliance with industry standards and regulations. Key responsibilities of this team include the development of governance policies, cyber risk management, third-party risk, overseeing SOX compliance, managing SOC2 compliance (amongst other frameworks) and ensuring privacy compliance across global operations. The team is actively modernizing how it works, shifting from point-in-time, evidence-heavy assessments toward continuous control monitoring and automation.

As a Senior Risk & Compliance Specialist, you will be a senior voice on the GRC Compliance team, ensuring that the organization's operations are conducted in a manner consistent with business practices, organization policies, and legal requirements, while adhering to compliance expectations. You will lead the build-out of our continuous control monitoring capability along with facilitating compliance to both current and emerging frameworks within IDEXX's scope. Lastly, you will be a champion of automation: suggesting, building, and deploying processes throughout Compliance to mature the program.

• You will lead external SOC2 audits, coordinating with both the external auditor and internal teams, and drive a unified evidence request list so that automated control test evidence stays fresh and can be reused "as-is" for external audits.
• You will lead the design and expansion of a continuous control monitoring (CCM) program, moving the team from periodic, sample-based testing toward automated, population-based assurance that answers "is this control working now?" rather than "did it work then?"
• You will apply AI to the GRC program itself, using it to map new regulations to existing controls, analyze evidence at scale, generate scripts for API-based evidence gathering, and draft findings and root cause analysis - while validating AI-driven output with professional skepticism.
• You will support the analysis of applying new regulations, standards, or frameworks to IDEXX, assessing compliance gaps, and supporting the implementation of new controls where applicable. A focus on the AI compliance space will be emphasized (EU AI Act, NIST AI RMF, etc.)
• You will monitor management against internal standards within the program, acting as the second line of defense before internal or external audits, and will escalate and quantify issues in business terms for leadership.
• You will communicate tactical and strategic updates to various business teams, leaders, and executive stakeholders.
• You will mentor and upskill members of the team, raising the bar on control testing, automation, and next-generation GRC skills.
• You will think and execute strategically and apply learnings from past projects to future ones, in addition to innovating the program to reflect industry trends or expectations.
• As a member of the GRC team, you will work across the full breadth of GRC, providing you exposure and influence beyond a single lane role.

• 5-7+years of experience within IT Audit, GRC (Governance, Risk & Compliance), Controls, Risk Assessment, or Internal Audit, including time operating as a senior or lead practitioner.
• Hands-on experience with continuous control monitoring or control automation - automated evidence collection, population-based control testing, policy-as-code, or cloud security posture management.
• Experience with AI and compliance - assessing or governing AI/ML systems against regulations and frameworks, or using AI tooling to accelerate compliance work such as control mapping, evidence analysis, or findings development.
• Experience leading readiness assessments and audits for SOC2; SOX, privacy, and third-party risk experience is a strong plus.Experience evaluating, analyzing, and onboarding new compliance regulations is a strong plus.
• You have one of these certifications: CISA, CISM, CISSP, CRISC, CRMAYou know how to develop, harmonize, and implement controls and processes through frameworks like NIST, COSO, COBIT, ISO 2700x, etc., including building a common control framework that maps to multiple obligations.
• You understand cloud-native architecture and security tooling (AWS, Azure, or GCP) and have worked within modern GRC platforms and their native integrations.You think strategically and focus on achieving goals together with your team.
• You communicate successfully in person and in writing and develop strong relationships with all levels in the organization.
• You can handle difficult issues in a professional, assertive, and proactive manner.
• Location: We are only considering those within the New England area of Maine, New Hampshire or Massachusetts. If local, we offer a flexible, hybrid of 8 days per month on site and we will consider less if you are further away.

• Base annual salary starting at $120,000, with flexibility based on experience
• Opportunity for annual cash bonus
• Health / Dental / Vision Benefits Day-One
• 5% matching 401k
• Additional benefits including but not limited to financial support, pet insurance, mental health resources, volunteer paid days off, employee stock program, foundation donation matching, and much more!

Why IDEXX?

We're proud of the work we do, because our work matters. An innovation leader in every industry we serve, we follow our Purpose and Guiding Principles to help pet owners worldwide keep their companion animals healthy and happy, to ensure safe drinking water for billions, and to help farmers protect livestock and poultry from diseases. We have customers in over 175 countries and a global workforce of over 10,000 talented people.

So, what does that mean for you? We enrich the livelihoods of our employees with a positive and respectful work culture that embraces challenges and encourages learning and discovery. At IDEXX, you will be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement.

Let's pursue what matters together.

IDEXX values a diverse workforce and workplace and strongly encourages women, people of color, LGBTQ+ individuals, people with disabilities, members of ethnic minorities, foreign-born residents, and veterans to apply.

IDEXX is an equal opportunity employer. Applicants will not be discriminated against because of race, color, creed, sex, sexual orientation, gender identity or expression, age, religion, national origin, citizenship status, disability, ancestry, marital status, veteran status, medical condition, or any protected category prohibited by local, state, or federal laws.

#LI-EV1