Responsibilities

• Supporting IT system A&A efforts by reviewing and evaluating security governance; To Identify the need for change in IT systems security based on new security technologies or threats; And to tests and implement new policies and to institute measures to ensure awareness and compliance with IT security policies and procedures.
• Reviews proposed new IT systems, networks, and software designs for potential security risks. Audits systems for security control compliance. Recommends mitigation or other countermeasures as necessary. Resolves integration issues related to the implementation of new systems within the existing infrastructure.
• Oversees the implementation of higher-level security requirements, such as those resulting from legislative, regulatory, or Presidential directives. Ensures the confidentiality, availability, and integrity of IT systems through full compliance with the Federal Information Security Management Act, related NIST standards, and agency IT security policies and standards. Continually evaluates current system security posture, monitors activities, and assesses the security awareness knowledge of staff as it relates to assigned areas of responsibility.
• Ensures the confidentiality, integrity, and availability of systems, networks, and data through the planning, analysis, development, implementation, maintenance, and enhancement of information systems security programs, policies, procedures, and tools.
• Administers information technology (IT) principles, methods, and security products to protect and maintain the availability, integrity, confidentiality, and accountability of information system resources.
• Implements and advises on IT security policies and procedures to ensure the protection of information transmitted from installation using Local Area Networks (LAN), Wide Area Networks (WAN), and Cloud Platforms such as but not limited to AWS, ServiceNow, Google Cloud Platform, and MS Azure.
• Accomplishes risk analysis, security testing, and certification due to modifications or changes to computer systems.

Qualifications

• 5 years of direct experience in information security, with a main emphasis on risk and compliance
• 3 years of expertise conducting ISO 27001 and SOC 2 audits, as well as handling audit responses
• Thorough understanding of market structures, including relevant regulatory compliance requirements (ISO27001, SOC 2 , NIST, FedRamp, CMMC, PCI, GDPR, etc.)
• Knowledge of identity management standards, storage, and disaster recovery in the cloud
• Knowledge of GRC tool techniques and best practices (ZenGRC, OneTrust, Archer)
• Proven track record of organizing and carrying out several risk and compliance projects
• Ability to successfully manage third-party audits, compile evidence, and organize audit responses
• Effective written and verbal communication skills and the capability to communicate with cross-functional teams
• Proven analytical and problem-solving abilities for managing initiatives that advance corporate goals