Principal Security Analyst, Governance Risk, and Compliance

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time Professional Plymouth, MN, US

7 days ago Requisition

Salary Range: $ To $ Annually

Histo Sonics is a commercial-stage medtech company advancing the Edison® System, a novel non-invasive sonic beam therapy based on histotripsy. Since receiving FDA De Novo grant for the non-invasive destruction of liver tumors in 2023, the company has progressed beyond initial market entry into commercial expansion, reimbursement momentum, and ongoing clinical and pipeline development. In addition to its current liver tumor indication, Histo Sonics is pursuing future indications across multiple applications including kidney, pancreas, prostate, neuro, women’s health, and other significant underserved human health areas, to realize the broader potential histotripsy across multiple disease states and medical specialties.

We offer an exciting work culture where cutting-edge science meets real-world application, and each team member’s contribution is important to our success in ensuring our physicians and their patients get what they need most.

Location: Plymouth, MN

Position Summary (Why this role matters):

The Principal Security Analyst, Governance Risk and Compliance is the senior-most individual contributor within the Histo Sonics governance, risk, and compliance function and is a member of a larger, multi-site Information Systems and Security team that supports Histo Sonics as a whole. This is a hybrid position based out of the Plymouth, MN office. The role owns the organization’s information security policy portfolio and Information Security Management System documentation, the mapping of internal ISO 27001 controls to the NIST Cybersecurity Framework, the resulting security maturity baseline and roadmap, third-party risk management, and security training and awareness.

The Principal Security Analyst provides the primary execution behind the Information Systems partnership with Legal on privacy policy and data protection matters, a partnership owned by the Senior Director, Information Systems and Security. The role serves as the highest level of escalation for security governance, risk, and compliance matters and sets standards and practices for the function.

Key Responsibilities (What you’ll do):

Security Governance and Policy

• Own the organization’s information security policy portfolio and Information Security Management System documentation, including authorship, periodic review, approval routing, version control, and retirement of policies, standards, and procedures.
• Lead the transition of Information Security Management System ownership and administration into the Information Systems and Security organization, and administer the policy exception and risk acceptance process, including analysis, compensating control review, documented approval by the appropriate authority, expiration tracking, and reporting.

Framework Alignment and Security Maturity

• Maintain authoritative control mappings between the organization’s ISO 27001 control set, the NIST Cybersecurity Framework, and other standards or customer and regulatory requirements adopted by the organization, keeping mappings current as controls, systems, and standards change.
• Conduct recurring security maturity assessments using the mapped framework, produce the maturity baseline, and maintain a prioritized multi-year improvement roadmap with defined target states, owners, and measures of completion.
• Coordinate internal and external audits and certification activities, including scoping, evidence collection standards, auditor engagement, and tracking of findings and corrective actions through closure, and maintain the control inventory and control owner assignments, verifying that assigned controls operate and are evidenced as designed.

Risk Management and Third-Party Risk

• Own the enterprise information security risk register, including risk identification, analysis, scoring methodology, treatment planning, ownership assignment, and periodic…