Lead Information Security Auditor, GRC

This is a fully remote position, open to applicants in Florida.

📋 Description

• Oversee the creation, implementation, and upkeep of cybersecurity policies, standards, procedures, and governance frameworks.

• Establish governance processes that are in line with business objectives and regulatory requirements.

• Ensure compliance with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and other relevant industry regulations.

• Create and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.

• Facilitate cybersecurity steering committees and governance forums.

• Monitor remediation efforts and ensure accountability for risk mitigation.

• Lead comprehensive cybersecurity risk assessments and risk management initiatives across the organization.

• Maintain a cyber risk register that includes enterprise IT, manufacturing systems, cloud services, and connected medical devices.

• Assess risks related to patient safety, operational resilience, intellectual property, regulatory exposure, and business continuity.

• Conduct risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.

• Formulate risk treatment plans and oversee mitigation efforts until completion.

• Convert technical security risks into business impact statements.

• Direct cybersecurity compliance initiatives and coordinate internal audits, external audits, regulatory inspections, and customer security evaluations.

• Manage the collection of evidence, validation of controls, tracking of remediation, assessments of maturity, and gap analyses.

• Collaborate with Internal Audit, Legal, Compliance, and Regulatory Affairs.

• Supervise audit findings and ensure corrective action plans are executed through to closure.

• Lead third-party cybersecurity due diligence and risk assessments.

• Define supplier security requirements and contractual security obligations.

• Assess supplier security posture and drive remediation efforts and risk acceptance.

• Collaborate with Engineering, Product Development, Quality, and Regulatory Affairs on product security governance.

• Oversee cybersecurity risk assessments for medical and surgical devices.

• Support governance of secure development and cybersecurity documentation.

• Facilitate coordinated vulnerability disclosure governance and manage vulnerability oversight.

• Lead initiatives for cybersecurity awareness, education, and compliance.

• Develop focused awareness programs and support phishing awareness, policy compliance, and security training.

• Measure and report on the effectiveness of programs and compliance trends.

• Assist with business impact analyses, resilience planning, tabletop exercises, and cyber crisis management planning.

• Evaluate recovery capabilities and resilience controls.

• Provide leadership for initiatives related to cybersecurity governance, risk, and compliance.

• Mentor cybersecurity professionals.

• Act as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs.

• Present updates on risk and compliance to executive leadership, committees, and external stakeholders.

• Assist in strategic cybersecurity planning and roadmap development.

⛳️ Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or a related field (or equivalent experience).

• Over 7 years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.

• Proven experience in developing and managing cybersecurity governance, risk, and compliance programs.

• Skilled in conducting risk assessments and managing enterprise risk registers.

• Experience in supporting internal audits, external audits, and regulatory examinations.

• Strong knowledge of cybersecurity frameworks and regulatory requirements.

• Background in healthcare, medical device manufacturing, life sciences, or regulated industries.

• Extensive understanding of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.

• Experience with enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.

• Ability to develop executive risk reporting, metrics, and presentations for the board.

• Familiarity with regulations concerning medical device cybersecurity and product security risk management.

• Preferred professional certifications: CISSP, CRISC, CISM, CGRC (formerly CAP), CISA, ISO 27001 Lead Implementer or Lead Auditor.

• This position is not eligible for employer visa sponsorship.

🏝️ Benefits

• Competitive compensation.

• Comprehensive healthcare coverage including medical, dental, vision, and prescription plans.

• Short and long-term disability coverage as well as life insurance, fully paid by CONMED.

• Retirement Savings Plan (401K) with CONMED matching contributions dollar for dollar, potentially up to 7% per pay period.

• Employee Stock Purchase Plan that allows stock purchases at a discounted price.

• Tuition assistance for both undergraduate and graduate courses.

• Incentives for the Employee Referral Program.