Sr IT/IS GRC Consultant – Information Security Policy Mgt.

HCSC•Richardson, TX

1d•Hybrid

About The Position

This position is responsible for serving as a thought leader in the governance, risk and compliance space; planning, designing, enforcing and auditing information technology and information security policies, standards and procedures which safeguard the integrity of and access to enterprise systems, files and data elements; analyzing, tracking and acting on information technology or information security policy exceptions, audits and assessments; maintaining knowledge of changing technologies, and provides recommendations for adaptation of new technologies, processes or policies; recognizing and identifying potential areas where existing information technology or information security policies, standards and procedures require change, or where new ones need to be developed, especially as a result of future business expansion and technology advances; providing management with analysis via risk assessments and briefings / reports to advise them of critical information technology / information security issues that may affect the company’s business objective and / or compliance; collaborating with and feeds it risk information into the enterprise risk management program; evaluating and recommending information technology and information security products, services and/or processes to reduce risk and maintain compliance with applicable policies, mandates, laws and regulations; implementing the activities associated with the information technology and information security awareness programs and provides education and training on information technology and information security policies, standards and practices; performing control assessments and works with appropriate subject matter experts (SME’s) to document remediation plans; serving as a project lead and mentor to junior GRC team members.

Requirements

Bachelor Degree and 5 years of IT / IS work experience with a broad range of exposure to systems analysis, application development, database design and administration.
Understanding of IT / IS concepts and how to articulate those in terms of risk.
Ability to recommend and develop strategic responses to issues and risks.
Ability to interpret internal or external business issues and concepts and translate those into IT concepts that must be addressed via policy.
Understanding of key IT / IS laws and regulations, such as the Health Insurance Portability and Accountability Act.
Understanding of governance and compliance frameworks (e.g. NIST, COBIT, ITIL, HITR HITRUST).
Understanding of and experience with audit and compliance controls.
Ability to respond appropriately to audit and assessment findings.
Initiate and invoke creativity to solve complex problems; takes an “outside –in” perspective to identify innovative solutions.
Collaborate well with individuals across the business and IT, as well as at all levels of the organization.
Verbal and written communication skills, including the ability to articulate complex concepts to various technical and non-technical audiences.
Experience with and understanding of overall GRC concepts.
Work independently, with guidance in only the most complex situations.
May lead functional teams and / or projects.

Nice To Haves

Bachelor Degree in Computer Science, Information Systems, or other related field.
Experience with a GRC solution.

Responsibilities

Serve as a thought leader in the governance, risk and compliance space.
Plan, design, enforce, and audit information technology and information security policies, standards, and procedures.
Analyze, track, and act on information technology or information security policy exceptions, audits, and assessments.
Maintain knowledge of changing technologies and provide recommendations for adaptation.
Identify areas where existing policies need change or new policies need development.
Provide management with analysis via risk assessments and reports.
Collaborate with and feed risk information into the enterprise risk management program.
Evaluate and recommend information technology and information security products, services, and processes.
Implement activities associated with information technology and information security awareness programs.
Provide education and training on information technology and information security policies, standards, and practices.
Perform control assessments and document remediation plans with SMEs.
Serve as a project lead and mentor to junior GRC team members.