Overview
Run information security governance, risk and compliance against ISO 27001 and NIST CSF.
What you'll do
- Maintain information security policies, standards and control frameworks
- Run risk assessments and track risks and treatments
- Test and evidence controls for internal and external audits
- Map controls to regulation and frameworks such as ISO 27001 or NIST
- Run third-party and supplier security assessments
- Report compliance status and risk to management
- Support remediation of audit findings
What you bring
- Hands-on GRC or information security risk experience
- Frameworks such as ISO 27001, NIST CSF, SOC 2 or PCI DSS
- Risk assessment and control testing
- Audit evidence and findings management
- GRC tooling such as ServiceNow GRC, Archer or OneTrust
- Clear written reporting
You don't need every item on this list. If most of it fits, send your CV.
Nice to have
- CISA, CRISC or ISO 27001 Lead Implementer certification
- Data protection regulation such as GDPR
- Third-party risk management
- Cloud control frameworks