Senior Information Security Risk Specialist (GRC)

SentinelOne

3d•Hybrid

About The Position

The Senior Information Security Risk Specialist supports the design and operation of SentinelOne’s organizational, procedural, and technological security controls within applicable security frameworks. The role applies a security-focused mindset that balances risk, business drivers, and timelines, and helps identify and test controls to confirm that they are appropriately designed, implemented, and operating effectively. It also helps implement, automate, document, and maintain controls while responding to inquiries from internal and external stakeholders. The specialist is expected to work independently as well as collaboratively. The role supports IT risk-based security audits and projects, risk assessments, compliance programs, control improvements, remediation tracking, security awareness, customer security reviews, and security metrics. It works with process and control owners throughout audit lifecycles and supports internal and external audits and evidence collection using a GRC tool.

Requirements

At least 5 years of experience working in information security, risk, or compliance.
Experience with security controls in some of these domains: access management, encryption, risk management, network security, configuration management, patch management, change management, awareness and training, and business continuity/disaster recovery planning.
Ability to perform internal audits with minimal direct supervision and exercise professional audit judgment.
Experience with a broad range of audit projects, such as SSAE 16/18 SOC 2, ISO 27001/2, and NIST.
Strong risk-management experience, including conducting assessments and audits, designing controls, managing enterprise control frameworks, and prioritizing risk.
Strong project-management skills and ability to manage multiple projects through completion within agreed timelines.
Excellent collaboration, interpersonal, written, and verbal communication skills for audiences at all organizational levels, including customers, partners, auditors, executive management, vendors, and peers.
Experience working with both technical and non-technical teams.
Ability and desire to understand the intent of requirements and provide effective recommendations.

Nice To Haves

An advanced degree in computer science, information technology, information security, or a related field.
Relevant certifications such as ISO 27001 LA/LI, CISA, CISM, CISSP, or CRISC.
Experience and strong understanding of common security compliance frameworks, controls, and best practices, such as COSO, SOC 2, SOX ITGC, ISO 27001/27002, GDPR, PCI, and NIST.
Ability to assess and pragmatically define scope and relevant controls.
Desire to continuously develop and deepen technical skills.

Responsibilities

Support the planning and performance of IT risk-based security audits and projects, risk assessments, fieldwork, and stakeholder communications.
Evaluate applicable global standards, compliance frameworks, and regulations; analyze existing controls, identify improvement areas, and design control growth.
Collaborate with process and control owners throughout the audit lifecycle, including process documentation updates, testing coordination, remediation of deficiencies, and advice on internal control enhancements or process changes.
Manage audit findings by tracking and documenting action-owner status updates and supporting timely remediation.
Participate in internal security and compliance programs; track recurring controls, including SSAE 18 SOC 2 and ISO 27001/27002; and support internal and external audits and evidence collection through a GRC tool.
Provide consultative control support to business redesign efforts to mitigate risk and improve compliance and operational performance.
Document new and update existing policies, procedures, standards, and resources.
Participate in the security awareness program and train personnel on data security and privacy-related processes and responsibilities.
Support customer security reviews, RFPs, and external security and privacy inquiries.
Participate in defining, collecting, and tracking security metrics.