Sr. Engineer, Governance, Risk & Compliance; TPRM

Job Description:

• Develop solutions using tools and technology to support Information Security and GRC work, project, and initiatives.
• Act as system administrator for certain security or GRC tools such as phishing and training platform, Data Loss Prevention (DLP) solution, Third Party Risk Management (TPRM) platform, Risk Register, privacy management, etc.
• Integrate related tools with other systems as needed.
• Engage with security vendors on design sessions, and help configure GRC solutions for use.
• Work with IT partners in Application Security, Security Engineering and Operations, Enterprise Applications, Desktop Support, Help Desk, Networking and Infrastructure Operations, to get data and information needed to support GRC work.
• Work with IT teams and partners to extrapolate SIEM related data from source system logs such as security, application, system, and network logs to assess risks and help the GRC team determine compliance.
• Work with IT teams and partners to bridge technology between GRC goals and cybersecurity / technology solutions such as IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPD, XDR, MDM, SIEM, etc.
• Support data analysis and metrics by pulling data from source systems.
• Stay current with threat intelligence and make recommendation for improvements.
• Participate in security incidents as needed.
• Support security assessment requests for customers, HITRUST, SOC 2, etc. by pulling appropriate data as needed.
• Work with IT partners to integrate GRC value-add into their secured software development life cycle, software engineering, infrastructure, network, and operation needs.
• Maximize the utilization of Security tools and technology.
• Assist with the development of policies and procedures.
• Stay current with changes in information security and cybersecurity regulations, industry frameworks, and best practices, and apply it to existing Next Gen GRC solutions.
• Use security engineering skills to help streamline or automate Next Gen methodology for maintaining accreditations or certifications (e.g., SOC 2, HITRUST, etc.).
• Use security engineering skills to help streamline or automate Next Gen methodology for responding to customer security assessments or questionnaires.

• Bachelor's Degree in Computer Science or related discipline or advanced degree.
• Or, any combination of education and experience which would provide the required qualifications for the position.

• 4-6 years of relevant experience or advanced Degree.
• Security engineering experience, including implementing information security or cybersecurity solutions.
• Experience in working with security technology, tools, or processes such as phishing campaigns, vulnerability scans, IRPs, playbooks, IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPD, XDR, MDM, SIEM, threat hunting, etc.
• Experience with one or more of the following frameworks: COSO, NIST CSF, RMF, ISO, COBIT.
• Experience working in an environment with one or more of the following:
  Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act (SOX), Security Operation Center (SOC), Payment Card Industry (PCI), GRC
• Experience working with IT partners and adequate exposure to their areas such as SSDLC, software engineering, infrastructure, networking, service desk, desktop support, security operations, etc. This includes experience or sufficient exposure and familiarity with the tools they use.

• Information security or cybersecurity related certifications such as CISA, CISSP, CISM, CRISC, CEH, GIAC (GCFA), or ability to acquire certification within 18 months.
• HITRUST Framework and CSF certification knowledge. Governance, Risk and Compliance tools.

• Knowledge of:
  
  GRC, information security, and cybersecurity principles, phishing campaigns, cybersecurity awareness and training, risk assessments, risk registers, security events and incidents, security frameworks, standards, guidelines, controls, federal and state security regulations and trends, current cybersecurity threats, data protection, administrative, technical and physical security controls, third party risk management (TPRM). IT / security processes or tools such as IAM, PAM, MFA, RBAC, SSO, DLP, IDS/IPD, XDR, MDM, SIEM, IRP, backups, DR & BCP, playbooks, MSP or MSSP, MDR or XDR, 24x7 SOC, endpoint security, SIEM, vulnerability scans, patching, pen testing, red/blue/purple teaming, tabletop exercises, encryption at rest and in transit, networking, firewalls, infrastructure, colo data centers, hosted environments such as Azure, AWS, or Google Cloud, and Active Directory.
• Skill in:
  
  Information security, cybersecurity, ethical hacking, some understanding of code and scripts, working as member of a team; communicating effectively; establishing and maintaining effective working relationships.
• Ability to:
  
  Determine how a system should work and how changes in conditions, operations, and the environment will affect outcomes; work in a fast-paced environment; stay organized, prioritize…