Security Engineer II – GRC

This is a fully remote position, open to applicants in United States.

📋 Description

• Respond to Requests for Proposals (RFPs) and security questionnaires.

• Collaborate with RFP, Legal, Privacy, Product, Engineering, and IT teams regarding security questionnaires, security exhibits, BAA/MSA/DPA inquiries, and customer follow-ups.

• Conduct risk assessments, Business Impact Analysis, business continuity and disaster recovery activities, and tabletop exercises.

• Review and update security, privacy, and compliance policies, procedures, and documentation.

• Assist in the implementation of privacy, data protection, and security controls.

• Lead vendor risk assessments and manage third-party risk management activities.

• Facilitate internal and external audits, including SOC 2 Type II, HIPAA, HITRUST, and ISO 27001.

• Contribute to FedRAMP, GovRAMP/StateRAMP, and public-sector compliance initiatives.

• Aid in the implementation and assessment of controls in alignment with NIST SP 800-53.

• Maintain and monitor POA&M, remediation activities, risk registers, and control deficiencies.

• Support Continuous Monitoring activities and the collection of audit and assessment evidence.

• Coordinate the collection, validation, and presentation of audit and compliance evidence.

• Assist in third-party assessments and collaborate with 3PAOs and external auditors.

• Identify control deficiencies and weaknesses, and develop action plans.

• Support security and privacy requirements across US healthcare, federal/state regulations, and Middle-Eastern regulations.

• Assist in AI governance and security initiatives, including ISO 42001 and NIST AI RMF.

⛳️ Requirements

• A Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field is preferred.

• 4-6 years of relevant experience in Information Security Risk & Compliance / GRC.

• Practical experience with HIPAA, SOC 2 Type II, ISO 27001, HITRUST, or similar security and compliance frameworks.

• Strong knowledge of security, privacy, risk, governance, and compliance controls.

• Experience in Vendor Risk Assessment and Third-Party Risk Management.

• Proficient in responding to RFPs, security questionnaires, customer assessments, and legal/security exhibits.

• Familiarity with audit, compliance, and evidence collection activities.

• Knowledge of FedRAMP, GovRAMP/StateRAMP, NIST SP 800-53, MARS-E, and ARC-AMPE.

• Understanding of POA&M, Continuous Monitoring (ConMon), security assessments, authorization processes, SSP, and 3PAO assessment activities.

• Familiarity with GDPR, HITECH, US state privacy/security regulations, and Middle-Eastern privacy regulations including PDPL.

• Knowledge of AWS, Azure, and/or GCP.

• Strong documentation, analytical, communication, and stakeholder management skills.

• Ability to work independently, manage multiple tasks, prioritize, and effectively manage time.

• Capability to collaborate and communicate with both technical and non-technical stakeholders.

• Willingness to work with teams and clients across US and Middle-Eastern time zones.

• ISO 27001 LA/LI, CISA, CRISC, or other relevant security and compliance certifications are advantageous.

🏝️ Benefits

• PTO benefit accrual of 20 days per year.

• Parental leave.

• Monetary incentives and rewards, along with recognition programs.

• Comprehensive medical, dental, and vision benefits.

• 100% company-sponsored short- and long-term disability insurance.

• 100% company-sponsored basic life insurance.

• Discounted legal aid services.

• Discounted pet insurance.