Job Title: Senior Cybersecurity Risk and Compliance Specialist

Location: Remote (occasional onsite)

Job Type: Full-time

Experience Level: Senior Level, Minimum 10 Years in Cybersecurity

About the Position:We are seeking a seasoned Senior Cybersecurity Risk and Compliance Specialist with a deep understanding of cybersecurity risk management, compliance frameworks, and threat assessment. The ideal candidate will have a minimum of 10 years of hands-on experience in conducting Threats and Risk Assessments, utilizing Cybersecurity Maturity Models, performing gap analyses, and preparing for and executing PCI and SOC (Service Organization Control) assessments.

Key Responsibilities: Risk:

Carry out various types of security assessments, including but not limited to:Security Posture Analysis

Cybersecurity Maturity Model Assessments
Cybersecurity Readiness Assessments
Security Gap Analysis
Compliance/Audit Readiness Assessments
Cloud Security Architecture Design and Governance
Cybersecurity Policy and Standard Development
Security Design Oversight and Governance
Network and Application Security Architecture Review and Risk Assessments

Identify potential vulnerabilities and provide detailed recommendations for mitigating identified risks.
Stay updated with the latest cybersecurity threats and trends.
Conduct supply chain, mergers, and acquisitions risk assessments.
Conduct cloud security risk assessments and provide guidance on cloud migration and cloud security architecture.
Conduct asset discovery and classification.

Cybersecurity Maturity Model Implementation and Gap Analysis:

Evaluate the organization’s cybersecurity maturity using established models.
Perform gap analysis to identify areas of improvement in cybersecurity practices.
Develop and implement strategies to close identified gaps and enhance the security posture.
Develop security strategies with roadmaps, priorities, and timelines.
Provide guidance and advice on the implementation of security strategies.

Compliance Assessment (PCI V3/V4 and SOC 1 & 2):

Lead PCI DSS compliance assessments.
Ensure proper documentation and evidence collection for compliance audits.
Perform evidence checking and identify gaps, developing detailed reports (ISO 27001, PCI-DSS, CMMC, SOC1/SOC2/SOC3, NIST).
Conduct readiness assessments to highlight any compliance gaps before an audit and provide remediation recommendations.
Provide guidance and support for maintaining ongoing compliance.

Policy and Framework Development:

Develop, update, and maintain cybersecurity policies and frameworks in line with industry best practices and compliance requirements.
Educate and train staff on compliance standards and cybersecurity best practices.

Stakeholder Engagement:

Collaborate with various internal and external stakeholders to ensure cybersecurity measures align with business objectives.
Present risk and compliance reports to senior management and key stakeholders.

Continuous Improvement:

Continuously monitor and improve the organization’s cybersecurity strategies.
Implement best practices for risk management and compliance.

Qualifications & Experience:

Bachelor’s degree in Information Technology, Cybersecurity, or a related field.
Minimum of 10 years of experience in cybersecurity, specifically in risk assessment, compliance, and threat analysis.
Proven hands-on experience with PCI DSS and SOC 1, 2, and 3 frameworks, particularly in evidence checking and conducting gap analysis.
Expertise in conducting TRAs, cybersecurity maturity assessments, and gap analyses.
Strong knowledge of current cybersecurity threats, trends, and risk mitigation techniques.
Solid understanding of cloud and cloud security solutions and frameworks (Azure, AWS, and Google).
Experience writing cybersecurity policies and standards.
Solid understanding and practical experience working with the Zero Trust framework.
Relevant certifications such as CISSP, CISM, CRISC, or similar.
Excellent analytical and problem-solving skills.
Superior verbal and written communication skills; ability to effectively communicate ideas and influence change at all levels of the organization.
Demonstrated experience in managing and improving IT security technologies and processes, security architecture, and cyber incident response.
Experience with the NIST Cybersecurity Framework and Ontario Cybersecurity Framework.
Strong stakeholder engagement and project management skills.
Strong problem-solving, decision-making, and analytical skills.
Strong organizational and time management skills, with the ability to multitask and meet deadlines.
Strong strategic business focus and commitment to partnering with clients to enable them to meet their objectives.
Ability to work independently and lead projects.

Technical Skills/Knowledge:

Practical knowledge of information security processes and functions, including asset management, vulnerability management, access management, and risk management.
Substantial knowledge and experience applying regulatory frameworks such as ISO 27001, CMMC, PCI-DSS, NIST SP 800-53, SOC1/SOC2/SOC3.
Experience performing PCI and SOC evidence checking and gap analysis.
PCI certification is an asset.
Extensive knowledge and expertise with technologies such as Firewalls, DNS Firewalls, Web Application Firewalls (WAF), Secure Email Gateways, Intrusion Detection and Prevention Systems (IDS/IPS), Security Incident and Event Management Systems (SIEM), Threat Intelligence, Data Loss Prevention (DLP), Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR), Forensics, Cloud Access Security Broker (CASB), Identity and Access Management, and Cloud Security Architecture.
Knowledge of additional standards, frameworks, regulations, and legislation governing information security and privacy (e.g., National Institute of Standards and Technology (NIST), ISO 27001, Control Objectives for Information and Related Technologies (COBIT), Personal Information Protection and Electronic Documents Act (PIPEDA)).

Job Type: Full-time

Schedule:

Monday to Friday

Work Location: Remote

Expected start date: 2024-03-11

Threat IQ Inc.

New Jobs

Sr. Cybersecurity Risk & Compliance Specialist