- Develop, implement, and maintain information security policies, standards, and procedures aligned with ISO 27001.
- Lead and mature the Information Security Management System, including risk treatment, internal audits, and external certification audit readiness.
- Conduct continuous monitoring and collect evidence for compliance with relevant frameworks.
- Plan and manage internal and supplier audits and prioritize GRC activities.
- Perform security risk assessments and gap analyses on new and existing systems, with a focus on cloud infrastructure.
- Collaborate with Product, Technology, IT, and Security teams to implement cloud and infrastructure security controls and provide technical guidance.
- Review risk mitigations and track remediation efforts to closure.
- Conduct third-party vendor risk assessments against required compliance standards.
- Develop and deliver security awareness and training focused on HIPAA and ISO 27001 requirements.
- Evaluate security technologies and processes and monitor cloud security threats, regulatory changes, and ISO 27001 updates.
AWSGCPAzure+1 more