Senior Information Security Risk Specialist – GRC

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in the planning and execution of IT risk-based security audits, projects, risk assessments, fieldwork, and communication with stakeholders.

• Assess global standards, compliance frameworks, and regulations; evaluate controls and identify opportunities for enhancements.

• Work alongside process and control owners to update documentation, coordinate testing, manage remediation, and enhance controls.

• Oversee audit findings, track status, maintain documentation, and handle remediation activities.

• Engage in security and compliance initiatives, including recurring controls for SSAE 18 SOC 2 and ISO 27001/27002.

• Assist with internal and external audits and evidence gathering utilizing a GRC tool.

• Offer control consulting for business redesign initiatives aimed at mitigating risks and enhancing compliance and operational efficiency.

• Document and revise policies, procedures, standards, and resources as needed.

• Participate in security awareness initiatives and educate personnel on data security and privacy obligations.

• Support customer security evaluations, RFPs, and respond to external security and privacy inquiries.

• Define, gather, and monitor security metrics.

⛳️ Requirements

• A minimum of 5 years of experience in information security, risk management, or compliance.

• Experience with security controls related to access management, encryption, risk management, network security, configuration management, patch management, change management, awareness and training, and BC/DRP.

• Capability to conduct internal audits with minimal supervision and experience with SSAE 16/18 SOC 2, ISO 27001/2, and NIST audit projects.

• Solid experience in risk management, encompassing assessments and audits, control design, enterprise control frameworks, and risk prioritization.

• Strong project management abilities, with a proven track record of managing multiple projects to successful completion within agreed-upon timelines.

• Outstanding written and verbal communication as well as interpersonal skills.

• Experience collaborating with both technical and non-technical teams.

• Willingness and capability to understand requirements and offer effective recommendations.

• An advanced degree in computer science, information technology, information security, or a related discipline is preferred.

• Relevant certifications such as ISO 27001 LA/LI, CISA, CISM, CISSP, or CRISC are preferred.

• Comprehensive understanding of security compliance frameworks, controls, and best practices, including COSO, SOC 2, SOX ITGC, ISO 27001/27002, GDPR, PCI, and NIST is preferred.

• Ability to evaluate and pragmatically define the scope and relevant controls.

• A commitment to continuously develop and enhance technical skills.

🏝️ Benefits

• Restricted Stock Units (RSUs).

• Employee Stock Purchase Plan (ESPP).

• Competitive leave benefits.

• Gender-neutral parental leave.

• Private medical, dental, and vision insurance.

• Global home office allowance.

• Internet or mobile phone allowance.

• Hybrid work model with flexible hours.

• Wellness programs.

• In-office lunch program.