Security Engineer - GRC/ISMS

Role overview

ISMS and risk management

• Manage and continually improve the ISMS; maintain information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance; facilitate ISMS management reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvements, and ensure regulatory and organizational compliance.
• Assess information security risks across projects, systems, vendors, and business processes; facilitate treatment plans, track mitigations, and escalate overdue actions.
• Support enterprise cyber and technology risk management.

Third-party and project security

• Conduct vendor security assessments and due diligence; review security clauses in MSAs, SOWs, DPAs, and other vendor contracts.
• Work with Procurement and Legal to assess SaaS, cloud, managed service, and technology vendors for security, privacy, confidentiality, and compliance risks.
• Recommend practical risk treatments and maintain third-party risk registers and remediation actions.
• Participate in project reviews and steering committees and ensure security requirements are addressed throughout project lifecycles.

Audit, incidents, and awareness

• Coordinate internal and external audits and serve as primary liaison for ISO 27001 audits.
• Maintain audit evidence repositories, track findings and remediation plans, and provide compliance reporting to management.
• Participate in incident governance reviews; support investigations, root cause analysis, lessons learned, and assessment of policy violations and control failures.
• Recommend corrective and preventive actions; coordinate security awareness initiatives, measure their effectiveness, and promote a security-conscious culture.

Required qualifications and experience

• Bachelor’s or Master’s degree in Information Security, Computer Science, Information Systems, or a related discipline.
• 15+ years of overall experience, including at least 10 years dedicated to Information Security GRC.
• Hands-on experience implementing and maintaining ISO 27001.
• Experience conducting third-party security assessments and reviewing technology contracts and security clauses.
• Experience supporting audits and certification activities and engaging with business and executive stakeholders.

Preferred certifications and competencies

• Preferred certifications include CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor, CDPSE, and ISO 22301 Lead Auditor or Implementer.
• Behavioral competencies include stakeholder management, analytical thinking, negotiation, report writing, risk-based decision-making, executive communication, and problem-solving.