Empyrean Benefit Solutions
Information Security & Risk Manager
Remote Information Security & Risk Manager at Empyrean Benefit Solutions who owns and advances the company's ISO 27001 ISMS, running security risk assessments, control testing, audit readiness (SOC 2, HIPAA, NIST), risk registers, and remediation, while fielding client security questionnaires and partnering with business and technology teams.
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 5+ years in information security risk, governance, compliance, technology audit, security engineering, or related areas, preferably in a technology or regulated environment
- Prior security compliance, risk, or audit experience, particularly with ISO 27001
- Strong understanding of security and control frameworks, including ISO 27001, SOC 2/TSC, NIST CSF, NIST 800-53, NIST AI RMF, CIS, and COBIT
- Working knowledge of information security, technology risk, audit, and control-assurance practices
- Working knowledge of control frameworks such as NIST CSF, SOC 2/TSC, CIS, ISO 27001/ISMS, COBIT, and ITIL
- Demonstrated knowledge of technology risks, including direct experience evaluating the effectiveness of cybersecurity, privacy, and engineering controls
- Strong understanding of cybersecurity processes and technology concepts (vulnerability management, incident response, logging and monitoring, SASE, zero trust, vendor risk management, PKI, penetration
- Advanced understanding of internal controls and ability to evaluate control design and operating effectiveness
- Experience with enterprise workflow, ticketing, directory, IT infrastructure, GRC, and security technologies
- Strong communication, presentation, and organization skills
- Strong time-management skills and ability to manage multiple priorities effectively
- Ability to effectively engage and work with a variety of roles and teams and contribute to cross-functional initiatives
- Strong written and verbal skills with experience preparing work papers, audit reports, and presentations
- Strong interpersonal skills with experience dealing with people of various levels of seniority
- High level of integrity and confidentiality
Nice to have
- Experience with SOC 2, HIPAA, NIST, FedRAMP, or similar frameworks
- Experience with ServiceNow and Jira
- Familiarity with relevant IIA and ISACA guidance
- Certifications such as CISA, CISM, CISSP, CIA, or ISO 27001 Lead Implementer/Lead Auditor
Full description
The Information Security & Risk Manager (ISRM) is an individual contributor responsible for supporting and advancing Empyrean’s information security governance, risk, compliance, and assurance program. The role provides leadership for the ISO 27001 Information Security Management System (ISMS), security risk assessments, control evaluation, policy governance, audit readiness, and remediation activities. The ISRM partners with business, technology, Security, Privacy, and leadership stakeholders to identify, assess, document, monitor, and communicate information security risks and to promote practices aligned with established policies, standards, and control requirements.
ESSENTIAL DUTIES AND RESPONSIBILITIES
- Lead Empyrean’s ISO 27001 certification, surveillance, internal audit readiness, and ongoing ISMS compliance activities.
- Coordinate ISO 27001 control testing and communications with control owners, business partners, and audit stakeholders.
- Support directly or indirectly other assessments and assurance activities, including SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and other applicable frameworks or requirements.
- Coordinate and collaborate with Empyrean business units to identify, assess, and communicate risks and control gaps in support of the established control environment and second-line-of-defense (2LoD) oversight.
- Partner with business and technology management to develop, implement, track, and validate corrective action and risk-remediation plans.
- Manage and coordinate audit and assessment activities related to ISO 27001, SOC, information security, cybersecurity, business applications, and integrated technology controls.
- Lead and/or coordinate information security risk assessments associated with major technology initiatives, material environmental changes, third parties, emerging technologies, control exceptions, and other identified risk events.
- Support and facilitate recurring security risk and governance meetings, including preparation, documentation, and follow-up activities.
- Maintain the enterprise information security risk register and related risk, issue, exception, and remediation documentation.
- Provides technical expertise to the teams and uses sound security and compliance practices.
- Applies analytical skills to review information and determine potential control weaknesses.
- Uses technical and compliance skills to design secure ways to accommodate exceptions to the established security policy in order to support the business.
- Participate in meetings with business units and control owners to discuss control requirements, assessment results, risks, and remediation activities.