Analyst, Governance Risk & Compliance

This is a fully remote position, open to applicants in Ukraine.

📋 Description

• Assist in ensuring that Trimble’s product portfolio complies with ISO 27001, ISO 27701, SOC 1 and 2, and NIST frameworks.

• Conduct gap analyses for ISO 27001, ISO 27701, SOC 2, and NIST 800-171, providing recommendations for process, procedural, documentation, and tooling improvements.

• Enhance the efficiency of compliance and certification scope by reviewing and refining the Trimble Common Control Framework.

• Execute internal audits for ISO 27001 and ISO 27701.

• Carry out internal and external audits for SOC 2 and NIST 800-171.

• Participate in annual policy updates and the upkeep of the Integrated Management System.

• Collaborate with business stakeholders and external auditors.

• Present metrics from the Integrated Management System, audit outcomes, risk trends, and corrective action plans to senior leadership.

• Develop processes and procedures aimed at enhancing compliance-program efficiency across various standards and frameworks.

• Work alongside Cybersecurity team members and Trimble businesses in diverse geographical locations.

• Support risk management processes, ensuring the business risk posture is accurately calculated and managed proactively.

• Generate and analyze data showcasing each business's risk posture, driving actions to mitigate and manage technical risks.

• Clearly communicate technical risks to a wide range of stakeholders, tailoring the delivery to suit the audience.

• Maintain communication with Cybersecurity, IT, GRC, leadership, cybersecurity representatives from divisions and sectors, software development teams, Human Resources, and Legal.

• Function independently as well as part of a global team.

⛳️ Requirements

• Knowledge of security frameworks and auditing security controls, encompassing ISO 27001, ISO 27701, ISO 42001, SOC 2, and NIST CSF.

• Background in conducting risk assessments and scoring, gap analyses, internal audits, and coordinating external audits.

• Willingness to engage in a project for 6 months followed by 6 months of auditing.

• Proficient in English, both written and spoken.

• Familiarity with ISO 27001, ISO 27701, SOC 2, and NIST 800-171.

• Capability to design audit controls across ISO 27001, ISO 27701, SOC 2, and NIST 800-171.

• Skill in drafting policies and interpreting complex business changes.

• In-depth understanding of risk management standards and guidelines.

• General IT knowledge, including networking, cloud computing, and software development.

• Basic understanding of data privacy regulations such as GDPR and CCPA.

• Exceptional skills in organization, presentation, communication, time management, analytical thinking, problem-solving, and decision-making.

• Ability to work autonomously, collaboratively, under pressure, and adapt to changing priorities.

• A degree in Data Science, Computer Science, or Engineering is preferred but not mandatory.

• Current general security certifications like SEC+ or GSEC are encouraged but not required.

• ISO 27001 Certified Internal / Lead Auditor certification or equivalent experience.

• Minimum of 2 years of experience with ISO 27001, ISO 27701, SOC 2, and/or NIST 800-171.

• At least 2 years of experience in risk management, information security, or systems engineer/administrator roles within a large international software organization.

• Practical experience with GRC tools such as Jira Service Desk.

• Experience in gathering information from various data sources and preparing reports for different audiences.

• Intermediate proficiency with Windows and Linux/Unix operating systems.

• Intermediate knowledge of cloud platforms including AWS, Azure, and GCP.

• Intermediate scripting skills and experience with Splunk and query creation.

• Familiarity with utilizing AI to streamline manual processes and procedures.

🏝️ Benefits

• Join a diverse and collaborative international cybersecurity team.

• Engage in a values-driven culture focused on Belong, Grow, and Innovate.

• Enjoy opportunities for career advancement.

• Make a meaningful contribution by sharing innovative ideas and developing impactful strategies.

• Request accommodations for applications as needed.