Security Engineer - GRC/ISMS - ISR

Role overview

Responsibilities

• Manage and continuously improve the ISMS; maintain security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance; facilitate ISMS management reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvement initiatives and ensure regulatory and organizational compliance.
• Conduct security risk assessments across projects, systems, vendors, and business processes; plan treatment and track mitigation.
• Support enterprise cyber and technology risk management.
• Assess vendors and review security clauses in contracts such as MSA, SOW, and DPA with Procurement and Legal.
• Evaluate SaaS, cloud, managed service providers, and technology vendors for security, privacy, confidentiality, and compliance risks; maintain risk registers and remediation actions.
• Participate in project reviews and steering committees to address security requirements across project lifecycles.
• Coordinate audits, act as primary liaison for ISO 27001 audits, maintain evidence, track findings, and report compliance.
• Support governance reviews and investigations of security incidents, root cause analysis, lessons learned, and corrective actions.
• Coordinate security awareness initiatives and measure effectiveness through metrics and reporting.

Required qualifications

• Bachelor’s or Master’s degree in Information Security, Computer Science, Information Systems, or a related discipline.
• 15+ years of overall experience, with at least 10 years dedicated to Information Security GRC.
• Hands-on experience implementing and maintaining ISO 27001.
• Experience conducting third-party security assessments and reviewing technology contracts and security clauses.
• Experience supporting audits and certification activities and engaging business and executive stakeholders.
• Strong stakeholder management, analytical thinking, negotiation, report writing, risk-based decision making, executive communication, and problem-solving skills.

Preferred certifications

• CISSP, CISM, or CISA.
• CRISC.
• ISO 27001 Lead Implementer or Lead Auditor.
• CDPSE.
• ISO 22301 Lead Auditor or Implementer.