Sr. GRC Specialist

DescriptionPosition SummaryAs a GRC Specialist focused on Product and Application Security, you will be responsible forensuring that Neptune Technology Group's products and applications adhere to the highestsecurity standards. You will engage with stakeholders throughout the organization and theproduct lifecycle to ensure that security practices are followed, and risk mitigations areimplemented where required Key Responsibilities : Application Security : Develop and maintain application security policies andprocedures. Ensure secure coding practices are followed and conduct regular securityassessments of applications to identify and mitigate vulnerabilities.Product Security : Integrate security requirements into the product design phase andmaintain a Software Bill of Materials (SBOM) for each product. Conduct security reviewsand audits to ensure compliance with industry standards.Security Standards : Develop, implement, and maintain security standards and bestpractices for product and application security.Security Reviews : Conduct security reviews and assessments of products andapplications to identify potential vulnerabilities and ensure compliance with securitystandards.Security Tools & Processes : Implement and manage security tools and processes,including Static Application Security Testing (SAST), Dynamic Application SecurityTesting (DAST), and penetration testing.Threat Modeling : Perform threat modeling to identify and mitigate potential securityrisks in products and applications.Incident Response : Lead incident response efforts for product and application securityincidents, including investigation, remediation, and reporting.Training & Awareness : Develop and deliver training and awareness programs toeducate stakeholders on product and application security best practices.Risk Assessments : Conduct risk assessments and develop mitigation strategies foridentified security risks.Collaboration : Collaborate with cross-functional teams, including development,operations, and legal, to ensure security requirements are integrated into the productdevelopment lifecycle.Documentation : Maintain comprehensive documentation of security assessments,reviews, and incident response activities.Qualifications :  Bachelor’s degree in information systems, Cybersecurity, or a related field. Minimum of 5 years of relevant experience in governance, risk, and compliance roles. Strong understanding of regulatory requirements and industry standards.Preferred Qualifications : Certifications such as ISO 27001, CISA, CISM, or CISSP.Experience with third-party risk management and vendor assessments.Knowledge of security frameworks such as ISO 27001, NIST, SOX or SOC 2.Skills : Analytical & Problem-Solving : Strong analytical skills with the ability to identify risks andpropose effective solutions.Communication & Leadership : Excellent communication skills with experience leadingcross-functional teams and working with senior management.Attention to Detail : Meticulous attention to detail in reviewing audit findings, compliancerisks, and policy documentation.Technical Expertise : Proficient in cybersecurity tools, and Microsoft Office Suite.Knowledge of GRC platforms is a plus.Ability to work independently and make decisions with wide latitude for independentjudgment.Travel Requirements : Typically require overnight travel less than 10% of the time.Location : Duluth, GA or remote.#HP1Equal Opportunity Employer / Protected Veterans / Individuals with DisabilitiesThe contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor’s legal duty to furnish information. 41 CFR 60-1.35(c)