GRC Security Analyst

Mid-Senior Level GRC Security AnalystWe need a mid-senior level Governance, Risk and Compliance (GRC) Security Analyst for a 6+ month contract for a public sector client in Long Beach, CA.The GRC Security Analyst will plan and implement policies, procedures, standards, and controls to govern the protection of corporate information systems, networks, and data. The GRC security analysts will stay up-to-date on the latest cybersecurity intelligence, including hackers' methodologies, in order to modify standards and controls that govern cybersecurity across the enterprise.Work is currently performed remotely with the expectation that some work could be performed on-site in Long Beach in the future. Thus, it would be preferable if the resource resides in the Western USA and ideally southern CA.Essential duties and responsibilities:Performing control assessments against cybersecurity frameworkPerform review of policies and supporting procedures/processesPerform assessments of adherence to standardsWork closely with management on security practicesAssess 3rd party vendors for adherence to standardsDevelop routine reports in accordance with GRC metricsStay on top of changes in the industry as it relates to securityOther security-related projects that may be assigned according to skillsRequired knowledge and attributes:Strong preference of consulting backgroundDemonstrated experience working in a team environmentStrong analytical skillsGreat time managementDemonstrated effective collaboration, comprehension and communicationRequired education and experience:Bachelor's degree in Computer Engineering, Computer Science, or Information Systems Management or equivalent work experience in the field of CybersecurityPossess current security certifications (e.g., CISM, SANS, CRISC, GSEC, etc.)Strong 3-5 years of experience in building an Information Security Risk Management programUnderstanding and familiarity with information system standardsUnderstanding and familiarity with cybersecurity frameworks (NIST, ISO, SANS Top 20, HiTrust, COBIT, etc.)Assist in maturing the Information Security Risk Management Program by helping to define an IS risk register which includes identifying threats and risks to the organizationMeet with business stakeholders to identify top security risksAssist in performing IS self-assessments to ensure systems and applications are complying with corporate policies, applicable regulatory and legal requirements, and leading industry practicesAssist in developing and driving the implementation of security best practices and standards to mature the overall IS Risk Management Program which includes defining security system and application standards of controlProvide solutions to identified issues and risksWorks with the CISO to determine the acceptable level of risk for enterprise computing platformsLiaise with key business divisions such as HR, IM, Communications, Finance, Security Services, Engineering, Risk Management, Maintenance, and others to identify new applications and service providers in use and the associated security controls to secure the dataAssist in performing Third Party Risk Assessments for new and existing vendor tools, on premise implementations, and third parties with access to the environmentAssist in maturing the Third Party Risk Management program by defining security controls based on tiers of vendorsArticulating identified risks to the business for remediation, mitigation and sign offInvestigate incidents and events that include potential PHI/PII and other data breaches, data leakage, brand reputational risks, malware propagation, system compromises, etc.Mature the Data Loss Prevention Program by defining DLP rulesets in existing tools and review outputs to determine the appropriate action requiredAssist in maturing the Data Governance Program which includes defining a Data Classification and Handling Program, identifying Data Owners, and assisting with the design and implementation of a Data Classification, Digital Rights Management and Data Loss Prevention toolsAssist in developing and maintaining Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) for the Data Governance Security Program and initiativesAssist in the management and maintenance of the enterprise-wide IM Security Awareness Program which includes phishing simulations, computer-based training, proactive communications on latest threats, workshops and newslettersAssist in developing enterprise and functional team specific presentations to promote a security mindsetWork with the CISO to ensure the Information Security team stays abreast of new regulatory, legal and/or compliance data security requirementsEnsure compliance with applicable legal and regulatory requirementsStrong documentation and communications skillsGood communication (oral and written) skillsProficiency with Microsoft suite of products (Teams, Word, Outlook, and Excel – required; Access and PowerPoint – preferred)Proven success in the pastA video interview will be required and the selected candidate will work remotely.