IT Specialist - SR. IT Specialist - IT Governance, Risk, and Compliance

Position: IT SPECIALIST - SR. IT SPECIALIST - IT Governance, Risk, and Compliance
Who We Are:

SwRI’s cybersecurity mission is to secure the enterprise by evaluating, implementing, and operating a full suite of cybersecurity tools, services, and processes. Objectives of this Role:
Compliantly pursue selection, acquisition, and maintenance of technologies. Apply cybersecurity frameworks and policies across the Institute and provide opportunities for remediations. Raise awareness of cyber risks to the Institute through the application of the risk assessment process and report to leadership for risk mitigation. Propose, generate, and review security metrics to demonstrate security progress and opportunities for improvement. Assist in contract review and third-party risk.

Daily and Monthly Responsibilities:
Performing advanced evaluations of the Institute’s compliance with cybersecurity internal controls and industry frameworks, and advising on remediation and strategic improvements Developing, refining, and monitoring Plans of Actions and Milestones to ensure security controls are brought into and maintained in compliance Executing and enhancing the Institute’s IT risk management process, providing senior-level analysis to inform enterprise risk and governance decisions Creating and improving training, standards, and guidance to strengthen and mature cyber governance processes across the Institute Conducting in-depth reviews of complex policy exception requests, performing detailed risk analysis, and providing recommendations to the CISO on risk reduction strategies and approval decisions Requirements:
Requires a Bachelors degree in Cybersecurity, Information Technology, or related degree with relevant experience. In lieu of a Bachelors degree, 6 years of Cybersecurity and/or IT administration experience an Associates degree or high school education or equivalent and related certifications is required. Certified Information Systems Security Professional (CISSP) preferred. 3 years:
Experience auditing IT controls environments or conducting compliance assessments 3 years:
Experience in any of various IT and security functions (E.g., IT audit, cybersecurity, IT administration, programming, contracts management, IT GRC) is desirable 3 years:
Knowledge of information security standards,

E.g., NIST 800-171 or 800-53, CIS Critical Security Controls 3 years:
Exposure to/understanding of the fundamentals of network and systems administration (e.g., Windows Server and desktop, Linux, TCP/IP, network subnetting) A valid/clear driver's license is required.