Bachelor's degree in Computer Science, Management Information Systems, Information Security, or related field.
7+ years of experience in IT and information security risk management, compliance, audit, and governance.
7+ years of experience leading information security risk assessments and control audits.
Strong technical knowledge of IT security technologies, including AWS, Azure, and M365.
Familiarity with information security frameworks like NIST CSF, HIPAA, SOC2, and ISO 27001.
Responsibilities
Advise IT and business units on identifying, assessing, and prioritizing cybersecurity risks.
Develop and maintain risk registers and metrics in collaboration with risk and control owners.
Manage compliance activities and coordinate with regulators and auditors for issue remediation.
Analyze findings to identify vulnerabilities and recommend improvements to controls and governance.
Facilitate monthly security risk meetings to report on activities and improvement opportunities.
Optimize the risk governance framework based on best practices and guide stakeholders in implementation.
Lead the development of third-party risk management policies and conduct assessments.
Benefits
Hybrid work schedule allowing up to 2 days of remote work per week.
Opportunity to work in a dynamic and evolving cybersecurity environment.
Access to ongoing professional development and training in GRC trends and technologies.
Full Job Description
Job Description
This position leads key functions within Cybersecurity Governance, Risk, and Compliance, including cybersecurity risk identification, assessment, prioritization, and lifecycle governance, as well as compliance and issue management. The ideal candidate will have experience analyzing findings to strengthen controls, improve governance processes, and advise IT and business stakeholders on mitigation strategies. This position is eligible for NRECA's hybrid schedule which allows for flexibility to work from home up to 2 days per/week.
Key Responsibilities
Advises IT and business units by leading activities to identify, assess, and prioritize cybersecurity risks, ensuring alignment with legal, regulatory, contractual, policy, and standard requirements.
Partners with risk and control owners to develop, implement, and maintain risk registers and metrics; governs and reports on risks and mitigations throughout the lifecycle; maintains risk management policies, standards, and the assessment plan.
Manages compliance and issue management activities, coordinating with regulators and auditors to track and remediate issues. Tests controls for design and effectiveness and partners with owners to implement remediation, reporting on findings and status.
Analyzes findings to identify vulnerabilities and opportunities to strengthen controls, governance, and mitigation. Proactively advises leaders on improvements and ensures proper prioritization and escalation of risks.
Performs cybersecurity risk governance, ensuring activities follow the governance framework and reporting on conformance.
Facilitates monthly security risk meetings to report activities, metrics, risks, and improvement opportunities.
Optimizes the risk governance framework based on best practices and guides IT and business stakeholders in implementing governance requirements.
Leads development of third-party risk management policies and standards and advises on the annual assessment plan; works closely with stakeholders on third party assessments and risk management. -party risk management policies and standards and party assessments and risk management.
Defines risk and control requirements for systems, data, and technology across cloud, on premises, and third-party environments; assesses system designs for risks and cybersecurity noncompliance. -premises, and third-party environments; assesses system designs for risks and cybersecurity non-compliance.
Maintains and continually develops expertise in GRC trends, technologies, and evolving methods to ensure organizational alignment with current practices.
Qualifications
Required Qualifications and Skills
Bachelor's in Computer Science, Management Information Systems, Information Security, or related field.
7+ years of experience in IT and information security risk management, compliance, audit, and governance.
7+ years of experience leading and conducting information security risk assessments, control audits, and third-party security risk assessments.
Strong technical knowledge of IT and information security technologies, including AWS, Azure, and M365.
Experience with information security frameworks, standards, and best practices such as NIST CSF, NIST RMF, NIST 800-30, NIST 800-53, NIST 800-171, HIPAA, SOC2, CIS, ISO 27001/27002, and COBIT.
Experience with GRC tools, reports and dashboards development, and compliance automation.
Preferred Qualifications and Skills
Technical knowledge pertaining to security hardening of OS, applications and networks
Experience reviewing system or network designs for risk and compliance that encompass multiple enclaves/networks, including those with different data protection or classification.
Conducted Third-Party Security assessments reviewing contracts for security requirements and inserting risk management practices within existing processes.
Led the implementation of technical security controls across all phases of the SDLC, ensuring alignment with security architecture standards and compliance requirements.
Preferred Certifications:
Information Systems Security Professional (CISSP)
Risk and Information Systems Control (CRISC)
Certified Information Systems Auditor (CISA)
Certified Information Systems Manager (CISM)
Essential Physical Requirements
The worker is required to have close visual acuity to perform an activity such as: preparing and analyzing data and figures; transcribing; viewing a computer terminal and extensive reading.
undefined
Exerting up to 20 pounds of force occasionally, and/or up to 10 pounds of force frequently, and/or a negligible amount of force constantly to move objects. If the use of arm and/or leg controls requires exertion of forces greater than that for sedentary work and the worker sits most of the time, the job is rated for light work.
Salary Range: $150,000-$185,000 annual salary
Final compensation determined by individual qualifications, experience, and internal equity.
Disclaimer Statement: The preceding job description has been written to reflect management's assignment of essential functions. It does not prescribe or restrict the tasks that may be assigned.
About National Rural Electric Cooperative Association
The National Rural Electric Cooperative Association (NRECA) is a national service organization that represents the interests of more than 900 electric cooperatives and their 42 million members across the United States. The organization provides a range of services to its members, including advocacy, education, training, and technical assistance. NRECA also works to promote the development of rural communities and the economic growth of rural America. The organization was founded in 1942 and is headquartered in Arlington, Virginia.
