Essential Duties and Responsibilities

• Lead compliance consulting projects with our clients to guild them on achieving their compliance target (NIST 800-171, SOC 2, etc)
• Perform risk assessments, identify IT controls for significant processes.
• Analyze risk and support risk assessment activities
• Understand technical implementation details necessary to assess security controls
• Participate in the development and oversight of required corrective action plans relating to security compliance issues
• Identify, research, and evaluate new compliance requirements and present them to relevant stakeholders
• Partner with Parachute team members and clients to ensure successful security programs align with compliance requirements
• Assist with aligning and codifying controls to show how they are mitigating information security risk
• Understand the security needs of internal and external stakeholders around external business partners
• Assist with daily activities and functions such as assessing vendors for security risk and provisioning application access
• Managed the information security compliance program, ensuring Parachute IT activities, processes, and procedures meet defined requirements, policies, and regulations.
• Internal and external policy creation and management.
• Managing Parachute’s SOC2 Type2 compliance documentation.
• Assist with managing SOC ticket escalation process.
• Manage vulnerability scan schedules and creating remediation tickets where needed.

Essential Technical Skills and Experience

• Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical internal and external stakeholders.
• Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies.
• Data privacy, compliance, security and project management
• Understanding of risks and internal controls and the ability to evaluate and figure out adequacy and efficiency of controls
• Basic knowledge and understanding of relevant legal and regulatory requirements, such as:

1. Sarbanes-Oxley Act (SOX)
2. Payment Card Industry/Data Security Standard (PCI)
3. Health Insurance Portability and Accountability Act (HIPPA)
4. National Institute of Standards and Technology (NIST)
5. Cybersecurity Maturity Model Certification (CMMC)
6. General Data Protection Regulation (GDPR)
7. The California Consumer Privacy Act of 2018 (CCPA)
8. Center for Internet Security Controls (CIS)

• 5+ years of IT skills with high level of information security experience and expertise
• Knowledge of information security risk management frameworks and compliance practices
• Knowledge of securing network technologies, client, and server operating systems.
• Ability to develop security standards and guidelines based on best practices and industry standards
• Ability to explain technical details to non-technical staff
• Excellent interpersonal, communication, and presentation skills, including formal report writing experience
• Have a love for technology
• Strong desire to be a part of, and contributing to, a high-performing team
• Willingness to learn and teach
• Strong sense of ethics
• GRC certification a plus (GRCP, CRISC, CGRC-IT)