Crisc Jobs (NOW HIRING)

1. Risk Assessment and Analysis

1. Lead complex IT risk assessments and threat modeling activities across systems and applications.
2. Analyze trends and emerging risks to proactively recommend strategic mitigations.

1. Risk Mitigation and Management

1. Develop and oversee implementation of advanced risk mitigation strategies.
2. Monitor risk programs and revise controls based on performance metrics and audit outcomes.

1. Compliance and Governance

1. Ensure enterprise-wide compliance with federal and state regulations, including HIPAA, IRS Pub. 1075, NIST 800-53, MARS-E, and ISO standards.
2. Support policy lifecycle management and contribute to enterprise GRC strategy.

1. Incident Management

1. Provide leadership in incident response and post-incident reviews.
2. Collaborate with internal teams on root cause analysis and long-term remediation planning.

1. Review System Security Plans (SSPs)

1. Review, update, and validate system security documentation for critical systems.
2. Ensure alignment with internal risk policies, external contractual requirements, and frameworks such as NIST and CIS.

1. External Audit Support

1. Serve as a key liaison to auditors and regulatory assessors.
2. Oversee evidence collection, audit response documentation, and control testing coordination.

1. IT Security Policy Leadership

1. Lead the creation and revision of organizational IT security policies.
2. Recommend and draft policy enhancements based on risk assessment results, audit findings, and regulatory changes.

1. Reporting and Documentation

1. Prepare and deliver executive-level reporting on risk posture, findings, and recommendations.
2. Maintain thorough documentation aligned with organizational and audit standards.

1. Collaboration and Communication

1. Represent IT risk in executive discussions, technical project meetings, and external partner engagements.
2. Coach and mentor junior staff, IT and business personnel.

Qualifications:

• Education:
  Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field is required.
  Master’s degree in a related field preferred.
• Experience:
  Minimum of 7 to 10 years of experience in IT risk management, cybersecurity, or information assurance.
  Demonstrated success leading cross-functional projects and managing compliance for large systems. Experiences in Heath and Human Services or Healthcare business preferred.
• Certifications (Preferred):
  CISA, CISSP, CRISC, CISM, CGEIT, or similar credentials.
• Technical Skills:
  Expertise in risk frameworks (NIST 800-53, MARS-E, ISO 27001), vulnerability management, system security plans, and audit lifecycle management.
• Analytical Skills:
  Exceptional critical thinking, data analysis, and risk prioritization abilities.
• Communication Skills:
  Strong verbal and written communication skills with the ability to tailor information to different audiences, including executives.

Skills

Required / Desired

Required  Amount of Experience in years

Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field is required.

Required

Master’s degree in a related field preferred.

Highly desired

Minimum of 7 to 10 years of experience in IT risk management, cybersecurity, or information assurance

Required

10

Experiences in Heath and Human Services or Healthcare business preferred.

Highly desired

CISA, CISSP, CRISC, CISM, CGEIT, or similar credentials.

Highly desired

Expertise in risk frameworks (NIST 800-53, MARS-E, ISO 27001), vulnerability management, system security plans, and audit lifecycle management.

Required

7

Demonstrated ability to collaborate across teams, influence without authority, and drive organizational change

Required

7