Lead Information Security Auditor – GRC

This is a fully remote position, open to applicants in Florida.

📋 Description

• Direct the creation, execution, and upkeep of cybersecurity policies, standards, procedures, and governance frameworks.

• Establish governance processes that align with corporate goals and regulatory obligations.

• Ensure alignment of the cybersecurity framework with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and relevant industry regulations.

• Create and deliver cybersecurity metrics, KPIs, KRIs, and risk dashboards to senior leadership.

• Facilitate cybersecurity steering committees and governance meetings.

• Monitor remediation efforts and ensure accountability for risk reduction.

• Lead comprehensive cybersecurity risk assessment and risk management initiatives across the enterprise.

• Maintain a cyber risk register that encompasses enterprise IT, manufacturing systems, cloud services, and connected medical devices.

• Assess risks associated with patient safety, operational resilience, intellectual property, regulatory compliance, and business continuity.

• Conduct risk assessments for technologies, initiatives, mergers, acquisitions, and strategic projects.

• Develop risk treatment plans and oversee mitigation activities.

• Convert technical security risks into business impact assessments.

• Spearhead cybersecurity compliance initiatives and coordinate internal audits, external audits, regulatory inspections, and customer security evaluations.

• Manage evidence gathering, control validation, remediation tracking, maturity assessments, and gap analysis.

• Collaborate with Internal Audit, Legal, Compliance, Quality, and Regulatory Affairs teams.

• Oversee audit findings and ensure corrective action plans are completed.

• Lead third-party cybersecurity due diligence and risk evaluations.

• Define supplier security requirements and contractual obligations; assess supplier security posture and drive necessary remediation.

• Collaborate with Engineering, Product Development, Quality, and Regulatory Affairs to integrate cybersecurity into the product lifecycle.

• Oversee cybersecurity risk assessments for medical and surgical devices and support secure development governance.

• Facilitate governance of coordinated vulnerability disclosure and oversee vulnerability management.

• Lead initiatives for cybersecurity awareness, education, compliance, phishing awareness, policy adherence, and security training programs.

• Measure and report on the effectiveness of awareness and compliance initiatives.

• Assist with business impact analyses, resilience planning, tabletop exercises, and cyber crisis management preparation.

• Assess recovery capabilities and resilience measures for critical processes and manufacturing operations.

• Provide leadership and direction for cybersecurity GRC projects.

• Mentor cybersecurity professionals and act as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs.

• Present risk and compliance updates to executives, committees, and external parties.

• Assist in strategic cybersecurity planning and roadmap development.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or a related field.

• Over 7 years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related fields.

• Certified Information Systems Auditor (CISA) certification.

• Proven experience in developing and managing cybersecurity governance, risk, and compliance programs.

• Demonstrated experience in conducting risk assessments and managing enterprise risk registers.

• Experience with internal audits, external audits, and regulatory inspections.

• Strong knowledge of cybersecurity frameworks and regulatory standards.

• Background in healthcare, medical device manufacturing, life sciences, or regulated industries.

• In-depth knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.

• Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.

• Experience in creating executive risk reports, metrics, and presentations for boards.

• Familiarity with medical device cybersecurity regulations and product security risk management.

• This position does not qualify for employer visa sponsorship.

• Preferred professional certifications: CISSP, CRISC, CISM, CGRC (formerly CAP), ISO 27001 Lead Implementer or Lead Auditor.

🏝️ Benefits

• Competitive salary.

• Comprehensive healthcare including medical, dental, vision, and prescription coverage.

• Short and long-term disability, along with life insurance, fully funded by CONMED.

• Retirement Savings Plan (401K) with CONMED matching contributions dollar-for-dollar, potentially up to 7% per pay period.

• Employee Stock Purchase Plan that allows stock purchases at a discounted rate.

• Tuition assistance for undergraduate and graduate courses.

• Employee Referral Program with incentives.