Exam & Audit Lead at Meta in Washington, DC

{"title": "Exam & Audit Lead", "description": "{\"__html\":\"\\u003Cspan>We are building a governance, risk, and compliance function to enable our company to build products that can withstand regulatory scrutiny, and to ensure Meta continues to meet global regulatory requirements and manage risk. Within the Regulatory Compliance Programs team, the Examinations & Audit (E&A) team owns Meta's readiness for, and execution of, external audit engagements \\u2014 including the independent audit required under the EU Digital Services Act (DSA) \\u2014 and operates at the intersection of policy, legal, engineering, and product.\\n\\n\\nWe are seeking a candidate to serve as E&A's most senior technical authority on control identification, technical response development, and evidence production across Meta's external audit portfolio. This is a portfolio-level role: rather than owning a single engagement, you will set the technical strategy that determines how Meta evidences regulatory compliance across multiple concurrent audits and regulatory regimes, and you will be accountable for whether that strategy holds up under independent testing.\\n\\nThis is both a technical program and project management role. You should be able to read a system design, follow a data flow, and reason about whether a given log, pipeline, config, or metric can withstand independent testing \\u2014 then drive the cross-functional work to make it so. At this level you are expected to do that at scale: establishing the evidence and control standards other teams build to, resolving the hardest and most ambiguous testability problems, and acting as the authoritative translation layer between external auditors and the engineering organizations whose systems are under examination.\\u003C\\/span>\"}", "minimum_qualifications": ["12+ years of experience in compliance, audit, technology risk, or technical program management, including significant experience in a technical program management capacity", "Experience setting the technical strategy for, or leading, multiple concurrent regulatory audit programs or external assessments (e.g., SOC, ISO, DSA, or government/regulatory audits). Deep experience with control identification, control design, and control testing, including establishing what constitutes sufficient and reliable evidence", "Technical acumen \u2014 demonstrated ability to reason about systems architecture, data flows, logging, and engineering trade-offs in the context of compliance requirements", "Experience directing technical evidence production across multiple engineering and data organizations under external deadlines", "Experience serving as a senior technical counterpart to external auditors, regulators, or independent assessors", "Experience developing and delivering AI-native strategies to scale compliance, assurance, or audit operations", "Demonstrated ability to operate as a single-threaded owner for highly complex, ambiguous, cross-functional portfolios", "Experience building governance structures, escalation processes, and reporting mechanisms that drive accountability across distributed teams", "Excellent written and verbal communication skills, with proven success influencing senior leadership across technical and non-technical audiences"], "preferred_qualifications": ["Demonstrated ability to integrate AI tools to optimize/redesign workflows and drive measurable impact (e.g., efficiency gains, quality improvements)", "Experience adhering to and implementing responsible, ethical AI practices (e.g., risk assessment, bias mitigation, quality and accuracy reviews)", "Demonstrated ongoing AI skill development (e.g., prompt/context engineering, agent orchestration) and staying current with emerging AI technologies", "Experience with the EU Digital Services Act, including the independent audit obligation, or comparable Trust and Safety, Youth, and/or other platform-accountability regimes", "Experience with audit and control frameworks (e.g., COSO, COBIT, NIST) and risk management methodologies such as control self-assessments, gap analyses, issue management, and compliance maturity models", "Experience building or scaling 1LoD / 2LoD audit and assurance programs at a technology company", "Experience developing compliance monitoring systems or automated controls embedded within software development or deployment pipelines", "Experience with data capability (e.g., SQL, log and pipeline analysis) sufficient to independently validate evidence populations and reported figures", "Experience with transparency reporting and integrity measurement methodologies, including metric definition, population scoping, calculation methodology, and data lineage", "Knowledge of global content regulations, content moderation, and Trust & Safety best practices", "Experience in Trust & Safety, Content Integrity, or Policy Compliance at a major technology platform", "Experience in regulated industries, information security, and/or cybersecurity", "Advanced degree and/or relevant certification (e.g., CIA, CISA, CRISC, CIPP)"], "responsibilities": ["Set the technical strategy for how Meta identifies, designs, and evidences controls across the E&A audit portfolio, spanning multiple regulatory regimes and concurrent engagements.", "Define the control architecture that maps regulatory obligations to the specific systems, pipelines, configurations, and enforcement mechanisms that implement them \u2014 and establish the standards other teams and subject matter leads build to.", "Own Meta's technical position on the most complex and contested auditor requests: determining what evidence exists, what it actually demonstrates, where it is authoritative, and how it must be presented to withstand independent testing.", "Serve as Meta's senior technical voice with external auditors, regulators, and independent assessors, coordinating Meta's technical position and submissions across engagements.", "Direct technical evidence production across the portfolio \u2014 scoping, sequencing across engineering and data teams, and validating that deliverables meet auditor expectations at first submission.", "Drive remediation of the most significant findings, holding accountable engineering and product owners to management action plans (MAPs) through to closure.", "Own maturation of E&A's control framework \u2014 control objectives, testing methodologies, and evidence standards \u2014 so that annual audit cycles are repeatable and scale as the regulatory portfolio expands.", "Scale audit and compliance effectiveness using AI to deliver monitoring, oversight, artifact generation, and org-wide continuous improvement; develop and deliver an AI-native approach to evidence gathering and control testing.", "Design the tooling, automation, and reporting architecture that gives leadership visibility into audit status, control health, evidence readiness, and remediation progress.", "Build consensus and buy-in across Product, Engineering, Legal, Policy, Data Science, Operations, and Internal Audit on control ownership and evidence obligations, surfacing risk and dependencies early with clear mitigation and escalation paths.", "Maintain an in-depth understanding of the evolving regulatory landscape affecting Meta \u2014 including Integrity, Youth, Privacy, and Security \u2014 and translate it into audit and control strategy.", "Mentor and develop technical program managers and subject matter leads across the team, raising the technical bar of the function."], "locations": ["Menlo Park, CA", "Washington, DC", "New York, NY"], "departments": ["AR/VR", "AI Research", "AI Infrastructure", "Security"], "public_compensation": [{"error_apology_note": "", "has_bonus": true, "has_equity": true, "compensation_amount_minimum": "$178,000/year", "compensation_amount_maximum": "$252,000/year"}]}