5+ years of experience in Information Security risk management, leading/managing assessments, security audits, and/or managing compliance requirements across an enterprise
5+ years of experience with regulatory compliance and frameworks such as NIST 800-53, NIST CSF, PCI-DSS 3.2 or higher, HIPAA, NYDFS 23 NYCRR 500, ISO 27001/2, and/or NAIC Data Security Law

My client, a global (re)insurance firm, are looking for a Cybersecurity GRC (Governance Risk & Compliance) Consultant to join their Enterprise Information Security (EISO) team to:

Analyze & document the Group's risk & compliance policies in relation to internal and external regulatory requirements.

Assist with third-party Risk Management, Cyber Risk Management and Cyber Compliance services.

Key responsibilities include, but are not limited to:

• Project Management for vendor-led risk assessments
• Manage Risk Issues in the enterprise Integrated Risk Platform (IRP)
• Support the reverse due diligence TPRM process with external audits, examinations, and survey requests
• Maintain the Enterprise Control Model (ECM) within the Integrated Risk Platform (IRP)
• Apply control language updates as needed
• Manage annual control owner confirmation processes
• Maintain control owners and control performers data
• Ensure authoritative sources are up to date including quarterly reviews
• Align new authoritative sources to the Enterprise Control Model
• Maintain risk library records
• Manage the Risk Activity Mapping (RAM) process to ensure that all RAM records in IRP are up to date
• This includes mapping risk activities to business processes and controls
• Manage quarterly reporting of KRIs and KPIs in Tableau and PowerPoint
• Support annual KRI and KPI development process
• Support the routine revision and monitoring of information security risk appetite
• Support routine and ad-hoc information security risk assessments
• Conduct routine reporting and analysis of risk issues, remediation plans, and risk acceptances

Successful Cybersecurity GRC (Governance Risk & Compliance) Consultants will:

Possess 5+ years of experience in Information Security risk management, leading/managing assessments, security audits, and/or managing compliance requirements across an enterprise

Have 5+ years of experience with regulatory compliance and frameworks such as NIST 800-53, NIST CSF, PCI-DSS 3.2 or higher, HIPAA, NYDFS 23 NYCRR 500, ISO 27001/2, and/or NAIC Data Security Law

This role requires thorough knowledge of information security risk management.

If you are interested or available, please apply now!