Risk and Compliance Manager

Functional Statement

Reporting to the Chief Information Security Officer (CISO), the Risk & Compliance Manager is responsible for: Designing, implementing, and leading a modern enterprise cybersecurity Governance, Risk, Compliance (GRC) program; Ensuring continuous improvements of governance, risk, and compliance capabilities; Ensuring cybersecurity risk is identified, measured, clearly understood, and managed in alignment with adopted frameworks, agency priorities, regulatory requirements, and overall technology strategy; Continuously monitor cybersecurity risk posture, perform gap analysis and provide recommendations for compensating technical, administrative, and physical controls; Tracking the agency's alignment to information security standards; Collaborating with agency stakeholders to develop prescriptive guidance to reduce risk; Reviewing policies, standards, procedures, controls documentation, and audit results; Managing third-party risk by maintaining an inventory of all technology providers and service organizations as well as performing continuous security posture monitoring; Overseeing the agency's security awareness program.

Essential Function 1

Develops and implements risk management plans and processes that are aligned to business objectives and security requirements. Collaborates with agency stakeholders and control owners to develop and implement testing and evidence gathering methodologies. Analyzes and interprets audit results and provides recommendations to system owners and senior leadership to reduce risk. Serves as risk management subject matter expert in support of agency projects. Leverages GRC, vulnerability management, and service desk tools to track progress and distribute compliance and risk remediation task assignments.

Essential Function 2

Conducts third-party service organization risk assessments to ensure supply chain risk is managed throughout the business relationship lifecycle. Establishes and maintains relationships with third-party vendors. Continuously monitors third-party risk by periodically gathering and analyzing vendor documentation such as System and Organization Controls (SOC2 Type II), International Organization for Standardization (ISO 27001), technical diagrams, penetration test results, continuity plans, etc. Reports on the benefits and risks for the agency as well as requirements for service provider compliance. Creates, maintains, and distributes third-party vendor security questionnaires. Serves as the agency's liaison to ensure successful external third-party risk and vulnerability assessments. Communicates assessment results to leadership, business stakeholders, and program managers. Documents Corrective Action Plans (CAP) as needed and assists with the creation of agency Plan of Action & Milestones (POA&M).

Essential Function 3

Assists with the research, creation, maintenance, implementation and communication of Information Security policies, standards, controls, and procedures documentation. Evaluates and documents technical, administrative, and physical controls to ensure the agency demonstrates compliance and meets the requirements of its regulatory obligations. Leads efforts to remediate control gaps and presents findings to leadership. Facilitates data collection and eDiscovery efforts to support investigations of policy violations. Collaborates with the Information Security Operations team and other agency stakeholders to analyze security incidents and provide recommendations to reduce risk. Establishes and maintains a detailed risk register for the organization. Oversee organization-wide Business Impact Analysis (BIA) processes. Collaborate with agency stakeholders to establish and maintain Continuity of Operations Planning (COOP) and Disaster Recovery Planning (DRP).

Essential Function 4

Develops and matures the agency's security awareness program. Utilizes a combination of third-party education resources and services, threat intelligence, and industry trends to create and distribute annual and supplemental security awareness trainings. Periodically provides agency staff with additional education opportunities such as presentations or workshops that are focused on information security, risk, and compliance.

Essential Function 5

Continues education by attending training, seminars, conferences, and obtaining industry certifications. Maintains a current understanding of the threat landscape by monitoring online information security related websites, blogs, articles, reports, as well as other security intelligence sources to remain current on the latest threats, indicators of compromise (IOCs) and trends. Participates in cybersecurity focused organizations.

Essential Function 6

Performs other duties as required or assigned which are reasonably within the scope of the duties enumerated above. Provides off-hours support as required.

Minimum Qualifications 1

Bachelor’s degree in a Cybersecurity or Information Technology field, and a minimum of 10 years in Information Technology roles including 5 years of combined professional experience in information security and risk management. 

Minimum Qualifications 2

Advanced knowledge in information security technologies, design, and architecture in on-premises and cloud hosted environments. 

Minimum Qualifications 3

Experience with the selection, implementation, and management of third-party GRC, exposure management, and awareness platforms such as Bitsight, Knowbe4, ServiceNow, Netwrix, Qualys, and Tenable. 

Minimum Qualifications 4

Solid understanding of cyber risk management, strategy, and security frameworks such as: NIST, CIS, OWASP, COSO, ISO, FAIR, etc. 

Minimum Qualifications 5

Must have excellent analytical and planning skills and be highly organized and detail oriented.

Minimum Qualifications 6

Possesses the ability to write and communicate effectively with both technical and non-technical audiences. 

Minimum Qualifications 7

Comfortability presenting to executive leadership. 

Minimum Qualifications 8

Ability to take unpopular positions when necessary to ensure risk is fully and accurately communicated to agency leadership.

Minimum Qualifications 9

The following professional certifications are required:

• ISACA Certified in Risk and Information Systems Control (CRISC)

• ISC2 Certified Information Systems Security Professional (CISSP)

• ISC2 Certified Cloud Security Professional (CCSP)

Preferred Qualifications 1

The following professional certifications are also desired:

• EC Council Certified Ethical Hacker (CEH)                           
• CompTIA Project+     
• CompTIA Cloud+
• ISC2 Certified in Governance, Risk and Compliance (CGRC) 
•  CompTIA Network+    
• COBIT: Control Objectives for Information and Related Technology  
• ITIL: Information Technology Infrastructure Library