Senior Security Assessor

Specialized Security Services, Inc.•Plano, TX

About The Position

The Senior Security Assessor supports client initiatives involving PCI compliance, ISO, NIST, CMMC, risk assessment, HIPAA, CCPA, and GDPR. The role conducts risk assessments, advises on implementing security measures, recommends risk mitigations, and interprets security policies and standards in project and business contexts. It has a significant client consulting and management component, including defining client security requirements according to industry best practices and ensuring projects meet those requirements or that exceptions and issues are documented and remediated appropriately. The Senior Assessor leads cybersecurity assessments and compliance engagements, evaluates controls and risks, supports security and privacy programs, and communicates findings and business-focused guidance to client stakeholders. The role also participates in developing enterprise security architecture and standards, conducts technical reviews, and serves as a client-facing governance, risk, and compliance consultant. Maintaining the role requires obtaining additional certifications to keep pace with the evolving cybersecurity landscape.

Requirements

A university degree in Computer Science, Engineering, or a field related to the role.
At least two security certifications from the following: (ISC)2 CISSP, ISACA CISM, ISACA CISA, SANS GIAC/GSNA, or ISO 27001 Certified Lead Implementer, Lead Auditor, or Internal Auditor.
Five or more years of information security experience in security governance, risk, and compliance practices and methodologies.
Hands-on experience as a security assessor or IT auditor for commercial clients.

Nice To Haves

Possession of a PCI QSA certification or the ability to obtain and maintain QSA status is strongly preferred.
Additional security certification such as QSA, CMMC CCP, CMMC CCA, IRCA ISMS Auditor or higher, IIA Certified Internal Auditor (CIA), or HITRUST.
Advanced knowledge of principles, best-practice architecture, and design approaches for capabilities, services, and standard controls within PCI-DSS, NIST, CMMC, and ISO.
Experience performing cybersecurity assessments and familiarity with industry cybersecurity tools or experience auditing systems.
Experience with security hardening techniques and policy development, particularly for secure software development methodologies and processes.
Previous experience with PCI-DSS, NIST, CMMC, or ISO compliance programs, including pre-assessments or assessments and gap-remediation programs.

Responsibilities

Lead and perform cybersecurity assessments, audits, gap analyses, readiness assessments, examinations, and formal compliance engagements.
Assess existing controls for compliance with standards and frameworks including PCI DSS, ISO, HIPAA, GDPR, NIST, and FedRAMP, including evaluating control maturity, compliance status, and risks associated with findings.
Support PCI-DSS, risk, NIST, ISO, CMMC, FedRAMP, and cybersecurity compliance gap analyses and assessments.
Support compliance and privacy client engagements involving GDPR, CCPA, PIPEDA, or similar privacy frameworks.
Support sites with testing, documentation, and issue resolution associated with cybersecurity programs.
Perform comprehensive threat and risk assessments and business impact analyses of systems, data, applications, and technology environments; identify threats to information assets and security measures needed to counter them.
Participate in developing and implementing enterprise security architecture and supporting security standards to ensure compliance with corporate policies and applicable legislative and regulatory requirements.
Perform technical security reviews or assessments to ensure systems, networks, applications, and data comply with corporate policies and standards.
Serve as a client-facing GRC consultant on S3 Security engagements, performing governance, risk, and compliance activities for client organizations as defined in contracts.
Assess and communicate risks, control gaps, and compliance implications, translating technical and operational findings into clear, business-focused guidance for client stakeholders.
Obtain additional certifications as needed to keep up with the cybersecurity threat landscape and industry-accepted certifications.