Senior Security Compliance Specialist

LaBella Associates•Rochester, NY

2d•Onsite

About The Position

We are currently looking to hire a Senior Security Compliance Specialist for LaBella's Operations Department. This position is located at our Rochester, NY office. The primary responsibilities of this position are the program management, administration, and maintenance of LaBella’s ISO 27001 and Information Security System (ISMS) program.

Requirements

Minimum of seven (7) years of experience in security compliance or audit program management.
Bachelor’s degree in Cybersecurity Management, technology compliance, or a related technology program management or auditing field. Directly related work experience may be substituted for formal education.
Strong understanding of IT infrastructure, networking, security, and software development.
Proven ability to work in a team environment, to foster teamwork, and to build collaborative relationships.
Self-motivated to continuously seek ways to aid and improve processes.
Strong communication and organization skills.
An uncompromised ability to keep information confidential.
Ability to follow and relay complex oral and written instructions, policies, procedures, and technical information clearly and effectively to both technical and non-technical audiences.

Nice To Haves

Preferred certification includes PMP, CISSP, related auditor or ISO document control certification.

Responsibilities

Management of LaBella’s ISMS committee including scheduling, providing agendas, and keeping minutes of meetings, ensuring membership is maintained as current and relevant.
Management of LaBella’s ISO 27001 and Information Security Management System (ISMS) program, in cooperation with the Security Operations Manager, including but not limited to: Security policy, process, and procedure development and maintenance, in cooperation with Security, IT, and other department and division leadership.
ISO 27001 document control, including versioning, management reviews and approvals, communication to employees, and updating/maintaining ISO 27001 document management sites including internal and external facing document control web-based sites.
Developing and maintaining risk assessment and risk acceptance workflow, risk treatment/mitigation plans, and updating LaBella’s risk register in coordination with relevant department and division leaders and executive management on required intervals.
Development of communication and coordination with executive, department, and division management, regional and office managers, internal and external communication managers, relevant third parties (clients, vendors, etc.), and LaBella data owners.
Coordinate ISO audits with internal and external resources and develop, track, and communicate corrective action plans
Collect and maintain ISO 27001/ ISMS evidence and control documentation, managing the GRC (Governance, Risk Management, and Compliance) platform
Establish and maintain an ISMS control ownership model, including assignment of control owners, control performers, approvers, review frequency, evidence requirements, and escalation paths for overdue or deficient controls.
Coordinate ISMS objectives, metrics, key performance indicators, and key risk indicators, and prepare recurring reporting for the ISMS committee, executive leadership, Security, IT, Operations, and other relevant stakeholders.
Maintain an ISMS compliance calendar covering internal audits, external audits, management reviews, policy reviews, risk assessments, access reviews, supplier reviews, evidence collection deadlines, training requirements, and certification milestones.
Coordinate with incident response, business continuity, disaster recovery, and crisis management stakeholders to ensure relevant plans, tests, lessons learned, and corrective actions are captured within the ISMS.
Promote continual improvement of the ISMS by identifying process gaps, control weaknesses, and opportunities to improve efficiency and consistency.
Coordinate with IT and Operations staff to ensure system performance and compliance with industry standards for physical and digital security items such as surveillance cameras, access control systems, endpoint management systems, 7x24 SOC, and information security management software as they relate to ISO 27001 certification.