• The GRC Specialist is responsible for reducing information security and cybersecurity risk to Client's by helping to prioritize and drive remediation efforts throughout the organization through the following:
• Establishing and maintaining governance and compliance standards.

Conducting risk assessments of vendor services or products, including but not limited to software, hardware, or other professional services as applicable.
Creating, maintaining, communicating, and enforcing information security related documentation, e.g., policies, frameworks, standards, methods & procedures, executive presentations, corporate communications, and knowledge base (KB) articles.

Advising senior leadership on risk management strategies, including risk mitigation, risk reduction, risk transfer, the risk exception process and residual risk analysis.The GRC Specialist independently executes high-quality, enterprise-class solutions consistent with regulations and established frameworks. The GRC Specialist holds team and organization level responsibilities and may lead small to medium scale projects. The Specialist works with employees, and leaders across client, as well as our clients, partners and suppliers, in select instances.Governance and ComplianceDevelops and implements a data security risk reporting framework, aligned with designated frameworks (ISO 27001, NIST SP 800-171, etc.) for management teams and governance committees.
Designs and documents technical, administrative, and physical controls to ensure the business demonstrates compliance, ensuring that client meets both the requirements and intent of its regulatory and compliance obligations.
Facilitates the remediation of control gaps and escalates critical issues to leadership.
Manages an exception review and approval process, and assures exceptions are documented and periodically reviewed.
Prepares for and facilitates examinations by qualified security assessors for regulations such as CMMC. Works closely with control owners and internal and external auditors to ensure requests are completed in a timely manner.

Assists with the evaluation of the effectiveness of the information security program by developing, monitoring, gathering, and analyzing information security and compliance metrics for management.Information Security Risk AssessmentIdentifies, analyzes, evaluates, and documents information security risks and controls based on established risk criteria.
Conducts security risk assessments of planned and installed information systems to identify vulnerabilities and risks.
Recommends controls to mitigate security risks identified via risk assessment process.

Communicates risk findings and recommendations that are clear and actionable by business stakeholders.Security Policy Management and Workforce Training and AwarenessSupports workforce security activities including culture, awareness, and training.
Facilitates eDiscovery and collection of data to support investigations of possible security or policy violations. Analyzes information security incidents in collaboration with other stakeholders. Coordinates remediation and awareness training.
Researches, recommends, and contributes to information security polices, standards, and procedures. Assists with the lifecycle management of information security policies and supporting documents.

Works with other organizational participants to implement information security policies.Third-party Supplier and Vendor Risk ManagementPerforms third-party supplier risk assessments to ensure supply chain risk is managed throughout the supplier's lifecycle. Assesses and reports on the risks and benefits for the business as well as mandates for supplier compliance.
Articulates results of the final assessments to business stakeholders, project sponsors, program managers, and other internal parties.
Assists with review of information security sections within supplier contracts, identifies gaps, and recommends security and data privacy content to close gaps.
Maintains inventory of relevant suppliers/vendors, controls, and risks for ongoing vendor risk management activities.

• Preferred5-7 years of progressively responsible experience in a healthcare setting, addressing risk and compliance with regulatory requirements (e.g., ISO 27001, SOC 2, PCI DSS, FedRAMP,).
• Licenses & CertificationsMinimumNonePreferredAdvanced certifications such as HCISSP, CISSP, CEH, CISM, CISA, CCSP, and/or specific training and certification in security risk management and IT controls frameworks, such as

NIST CSF and 800-53 and 800 171.

• Requirements:EducationMinimumAssociate Degree in Healthcare, Information Technology, Business, or related field (2 years of relevant experience may be considered in lieu of degree in addition to experience below)PreferredBachelor’s or Master’s degree in Healthcare, Cybersecurity, Information Technology,

Engineering, Business, or related field preferred.Work ExperienceMinimumDemonstrated success performing risk assessments, writing policies to comply with governmental regulations, or implementing other key GRC functions.
Demonstrated success leading small to medium scale projects.

Job Type: Contract

Benefits:

• Health insurance

Schedule:

• Monday to Friday

Work Location: In person

Please Note :
blog.nvalabs.org is the go-to platform for job seekers looking for the best job postings from around the web. With a focus on quality, the platform guarantees that all job postings are from reliable sources and are up-to-date. It also offers a variety of tools to help users find the perfect job for them, such as searching by location and filtering by industry. Furthermore, blog.nvalabs.org provides helpful resources like resume tips and career advice to give job seekers an edge in their search. With its commitment to quality and user-friendliness, Site.com is the ideal place to find your next job.