Senior Technology Risk Specialist

Senior Technology Risk Specialist

TraceLink is seeking an experienced security professional to join our Security Assurance team, reporting to the Director, Security Assurance. This individual is responsible for helping the Director drive alignment of TraceLink’s IT assurance programs with relevant industry and global regulations and standards and ensure ongoing adoption of best practices. Primary focus is on information security and risk management. This role will also support business continuity, vendor oversight, and other cross-functional initiatives in partnership with Regulatory & Quality Compliance, Legal, IT, Finance and other departments. This is an exciting opportunity to improve the strength of TraceLink’s information security management system, coordinate independent review and certification/attestation, and solidify customers’ trust in TraceLink.

­

• You will play an important role in the operation, support, and maintenance of TraceLink’s Information Security Management System (ISMS), certified against ISO 27001 and supporting our SOC 2 attestation.
• You will help develop plans to adopt and meet requirements of additional assurance programs as needed to support the business.
• You will help review and manage security policies, standards, procedures, and guidelines to ensure complete coverage with relevant standards, frameworks, and regulations
• You will handle controls inventory and alignment with relevant standards, frameworks, and regulations
• You will participate in performing internal audits and risk assessments of functions, processes, and controls to drive development of remediation OR mitigation plans to improve design and operational effectiveness
• You will liaise with Subject Matter Experts (SMEs) to drive continual improvement and obtain required approvals
• You will manage security exception process and tracking
• You will manage remediation of nonconformities and corrective actions
• You will support managing the independent certification and attestation audits
• You will support departments with security-related requirements for internal projects or external vendors
• You will perform vendor risk assessments to support due diligence and oversight
• You will coordinate with vendor managers to ensure identified risks are addressed
• You will support responses to customers and prospects for RFIs, RFPs, and questionnaires
• You will support privacy regulation compliance initiatives

Skills And Requirements

• 5-8 years of relevant professional experience in risk management, compliance, regulatory or other governance and control related information security role where risk-based methodology is used.
• Some project management experience with demonstrated success in leading, controlling, and completing IT projects.
• Demonstrated ability to achieve results by collaborating with cross-functional, virtual teams across multiple time zones.
• Experience as part of a team designing, implementing, maintaining, and supporting an Information Security Management System (ISMS) based on ISO 27001
• Excellent verbal and written communication skills, includes presentations skills
• High attention to detail and excellent analytical, reasoning, and problem-solving skills, includes knowledge on MS-Office applications.
• Able to work independently with minimal guidance and act as coach to other team members / stakeholders as necessary.
• Strong working knowledge of IT processes and infrastructure and tools
• Strong working knowledge of risk management
• Proven working experience as Internal / Senior Auditor with understanding of auditing and control practices.
• Experience in conducting ISO 27001 / 27017 and SOC 2/ISAE 3000 Audit participation, or other accredited audit certification and attestation
• Possessing at least one or more of the following certifications(s) (Lead Auditor ISO 27001/ CISA/ CCAK CRISC/ CCSP/ CGEIT or CISM).
• Strong organization and document management skills
• Ready to work in flexible shifts
• Ability to travel to US Headquarters if required

• Bachelors degree in Computer Science /Information Systems Security or Any other equivalent professional certifications / work experience related to Security field.
• 5+ years of industry experience with strong background in technology risk management or Experience working in Security Audit team.
• Experience in a software company, designing and applying IT controls in a cloud-first culture
• Experience with threat modeling or other risk identification techniques
• Familiarity with relevant standards and frameworks, including:
• Security & Risk Management: ISO 27017, 22301, and 31000; SOC 1/2/3; NIST CSF and 800-53; CSA Cloud Controls Matrix, HIPAA/HITRUST requirements
• Privacy: GDPR, CCPA, and ISO 27018 and 27701
• Service Management: ISO 20000, ITIL
• Quality: GxP, ISO 9001
• PMP or other project management certification