Information Security & Risk Manager

The Information Security & Risk Manager (ISRM) is an individual contributor responsible for supporting and advancing Empyrean’s information security governance, risk, compliance, and assurance program. The role provides leadership for the ISO 27001 Information Security Management System (ISMS), security risk assessments, control evaluation, policy governance, audit readiness, and remediation activities. The ISRM partners with business, technology, Security, Privacy, and leadership stakeholders to identify, assess, document, monitor, and communicate information security risks and to promote practices aligned with established policies, standards, and control requirements.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Lead Empyrean’s ISO 27001 certification, surveillance, internal audit readiness, and ongoing ISMS compliance activities.
• Coordinate ISO 27001 control testing and communications with control owners, business partners, and audit stakeholders.
• Support directly or indirectly other assessments and assurance activities, including SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and other applicable frameworks or requirements.
• Coordinate and collaborate with Empyrean business units to identify, assess, and communicate risks and control gaps in support of the established control environment and second-line-of-defense (2LoD) oversight.
• Partner with business and technology management to develop, implement, track, and validate corrective action and risk-remediation plans.
• Manage and coordinate audit and assessment activities related to ISO 27001, SOC, information security, cybersecurity, business applications, and integrated technology controls.
• Lead and/or coordinate information security risk assessments associated with major technology initiatives, material environmental changes, third parties, emerging technologies, control exceptions, and other identified risk events.
• Support and facilitate recurring security risk and governance meetings, including preparation, documentation, and follow-up activities.
• Maintain the enterprise information security risk register and related risk, issue, exception, and remediation documentation.
• Provides technical expertise to the teams and uses sound security and compliance practices.
• Applies analytical skills to review information and determine potential control weaknesses.
• Uses technical and compliance skills to design secure ways to accommodate exceptions to the established security policy in order to support the business.
• Participate in meetings with business units and control owners to discuss control requirements, assessment results, risks, and remediation activities.
• Partner with Security and Privacy teams to understand the information security and privacy risk profile and apply that knowledge to risk, audit, and assurance planning.
• Lead the development and coordination of information security and technology responses for client security questionnaires, RFPs, due-diligence requests, internal inquiries, and related materials; participate in client meetings as a security and risk subject-matter expert when needed.
• Partner with security and engineering teams to review, assess, and evaluate the effectiveness of the enterprise cybersecurity threat and vulnerability monitoring and management plan.
• Identify gaps in security policies, standards, and supporting documentation and develop or revise documentation to address identified needs.
• Maintain and coordinate updates to information security policies, standards, and related governance documentation.
• Work cross-functionally on technology initiatives to provide security risk and IT controls expertise, evaluate control design and implementation, and support alignment with established control requirements. Apply knowledge of applicable legal, regulatory, contractual, and privacy requirements when evaluating information security controls.
• Work with management and users to interpret the significance of audit findings, conclude on findings, make practical recommendations, and verify that remediation plans are implemented.
• Provide cross-functional support to broader information security initiatives, incidents, escalations, and priority projects as business needs require.
• Support security roadmaps, business plans, incidents, escalations, and strategic initiatives as needed.

REQUIRED SKILLS AND ABILITIES

• Strong communication, presentation, and organization skills
• Strong time-management skills and the ability to manage multiple priorities effectively
• Ability to effectively engage and work with a variety of roles and teams
• Prior security compliance, risk, or audit experience, particularly with ISO 27001; experience with SOC 2, HIPAA, NIST, FedRAMP, or similar frameworks is a plus.
• Ability to contribute to cross-functional security, technology, risk, and assurance initiatives.
• Strong written and verbal skills with experience preparing work papers, audit reports, and presentations
• Strong interpersonal skills with experience dealing with people of various levels of seniority
• Working knowledge of information security, technology risk, audit, and control-assurance practices; familiarity with relevant IIA and ISACA guidance is beneficial.
• Strong understanding of security and control frameworks, including ISO 27001, SOC 2/TSC, NIST CSF, NIST 800-53, NIST AI RMF, CIS, COBIT, and other applicable frameworks.
• Experience with enterprise workflow, ticketing, directory, IT infrastructure, GRC, and security technologies; experience with ServiceNow and Jira is beneficial.
• High level of integrity and confidentiality.
• Relevant certifications such as CISA, CISM, CISSP, CIA, ISO 27001 Lead Implementer/Lead Auditor, or equivalent are preferred.

KNOWLEDGE, EXPERIENCE AND/OR EDUCATION REQUIREMENTS

• 5+ years of experience in information security risk, governance, compliance, technology audit, security engineering, or related areas, preferably within a technology or regulated environment.
• ISO 27001 Lead Implementer or Lead Auditor training and/or relevant certifications such as CISA, CISM, or CISSP are preferred.
• Working knowledge of information technology and security best practices and control frameworks such as NIST CSF, SOC 2/TSC, CIS, ISO 27001/ISMS, COBIT, and ITIL.
• Demonstrated knowledge of technology risks, including direct experience evaluating the effectiveness of cybersecurity, privacy and engineering controls.
• Strong understanding of cybersecurity processes and technology concepts, including vulnerability management, security governance, software development, incident response, physical security, logging and monitoring, microsegmentation, secure access service edge (SASE), zero trust, insider threat, vendor risk management, PKI, penetration testing, application controls, and segregation of duties.
• Advanced understanding of internal controls and the demonstrated ability to evaluate and determine the adequacy of control design and operating effectiveness.

Disclaimer: This job description is not intended to be an exhaustive list of all duties, responsibilities, or qualifications associated with the job. Management reserves the right to modify or reassign job duties as business needs evolve.

Empyrean is an Equal Opportunity Employer: including disability and protected veteran status

Originally posted on Himalayas