Governance / Risk / Compliance Engineer - Intermediate level

Job DescriptionJob Description

Job Summary

The GRC Engineer will be responsible for implementing, maintaining, and improving policies, standards, procedures, and internal controls to assure compliance with applicable regulatory and legal requirements, as well as information security best practices.

The ideal candidate will have a security engineer mindset to building out GRC frameworks, automation, and integration of technical controls.

The GRC Engineer will proactively work with key business stakeholders to assess and design controls to reduce information security risk.

The GRC Engineer should understand and articulate the impact of information security controls on the business and be able to communicate this to stakeholders.

Primary Responsibilities:

• Risk Assessment: Identify, assess, and prioritize risks that could impact compliance, financial health, or reputation.
• Compliance Management: Develop, implement, and maintain compliance programs and policies that align with regulatory requirements and industry best practices.
• Auditing: Conduct internal and external audits to assess compliance with regulations and identify areas for improvement.
• Reporting: Prepare and analyze compliance reports, metrics, and dashboards to track progress and identify trends.
• Training and Awareness: Develop and deliver training programs to educate employees about compliance requirements and information security best practices.
• Incident Management: Respond to compliance incidents, conduct investigations, and implement corrective actions.
• Technology Implementation: Evaluate and implement GRC software and tools to streamline compliance processes and improve efficiency.
• Continuous Improvement: Exploring opportunities to improve GRC processes through automation and continuous monitoring of information security controls, risks, and exceptions, and development of reporting metrics, dashboards, and evidence artifacts.
• Assisting in the development and ongoing oversight of a vulnerability management program.
• Managing the remediation of risks identified through the risk register process and contributing to the improvement of risk treatment plans and the overall risk management program.
• Managing the security exception process, including the completion of security exceptions, tracking, and following up on alternative mitigating action items detailed within approved security exceptions.
• Coordinating and tracking security-related audits including scope of audits, stakeholder engagement, and deliverable timelines; working with teams as appropriate to achieve audit readiness; providing guidance, evaluation, and advocacy on audit responses.
• Maintaining the vendor risk management program including vendor reviews and vendor risk assessments; improving the program with the build-out of repositories, tools, and documentation for third-party vendor risk assurance.

Education:

• Bachelor’s degree in a technical discipline related to Information Technology.
• Professional certifications are a plus.

Experience:

• 2-4 years of experience in Information Technology, Security Engineering, Governance, Risk and Compliance and/or Internal Audit management.
• Experience with GRC software tools and platforms (e.g., Vanta): Designing, Implementing, and Managing GRC tools and technologies to streamline processes for risk assessment, compliance monitoring, and incident management, including development of automation tools and automating auditing tasks.
• Experience conducting risk assessments on operational processes, procedures, and policies; interpreting audit results and making conclusions on the adequacy and reliability of controls; preparing and presenting reports, as necessary.
• Experience reviewing risk analysis, drafting corrective action plans, and driving the risk treatment process.
• Experience conducting security compliance reviews and audits of on-premises and hosted environments, including AWS and Azure.
• Experience working in a SaaS company environment.
• Proven experience in implementing and maintaining HITRUST CSF and ISO 27001 compliance frameworks.
• Experience working in a highly regulated industry vertical (e.g., healthcare).

Skills:

• Strong understanding of fundamental information security concepts and technology.
• Understanding of technical and organizational security vulnerabilities, threats, and risks.
• In-depth knowledge of security framework controls as they apply to public cloud (AWS ), hybrid, self-hosted, and SaaS environments.
• Strong knowledge of information security risk management and information security technologies (e.g. SIEM, vulnerability management, data loss prevention, and/or endpoint protection).
• Skilled at applying a risk-based approach to planning, executing, and reporting on audit engagements and auditing processes.
• Knowledge of common information security management frameworks, such as ISO/IEC 27001 and HITRUST.
• Ability to transform and communicate organizational compliance requirements into internal engineering requirements for various teams including software development and IT.
• Excellent analytical, problem-solving, and decision-making skills.
• Strong communication (written and verbal) and presentation skills.

Company DescriptionIntegrity Resources was formed in 2010 as a result of years of staffing experience combined with the need for a better industry model. Where we differentiate from other organizations is that we operate based on relationships. Our approach takes into consideration every aspect of a hiring requirement from BOTH the client and the candidate. Our desire to listen, learn, and understand our customers culture AND specific candidate needs along with our ability to provide exemplary customer service enables us to maintain and develop long term relationships across the staffing industry.
If you don’t believe us, feel free to reach out today....you’ll notice the difference a true business partner makes.Company DescriptionIntegrity Resources was formed in 2010 as a result of years of staffing experience combined with the need for a better industry model. Where we differentiate from other organizations is that we operate based on relationships. Our approach takes into consideration every aspect of a hiring requirement from BOTH the client and the candidate. Our desire to listen, learn, and understand our customers culture AND specific candidate needs along with our ability to provide exemplary customer service enables us to maintain and develop long term relationships across the staffing industry. \r\nIf you don’t believe us, feel free to reach out today....you’ll notice the difference a true business partner makes.