Senior Associate of Security Governance, Risk, and Compliance, Gemini

• BA/BS degree in a technical field or equivalent practical experience
• 5+ years of experience in the Information Security Governance, Risk and Compliance field or as a Technical Program/Project manager
• Extensive expertise in planning, managing, and completing Information Security compliance audits
• Experience with key information security frameworks, including ISO 27001/2, ISO 27018, ISO 22301, PCI DSS, SOC 2, and the NIST Cybersecurity Framework
• Knowledge of regulations like NYSDFS Reg. 500, CBI, UK FCA, and similar regulatory bodies
• Skilled in advising on both current and emerging information security regulatory and compliance standards
• Experience in security compliance testing and ongoing control monitoring
• Exceptional analytical and creative problem-solving abilities
• Strong interpersonal skills for effective collaboration with customers, senior level personnel, auditors, and team members
• Strong organization skills to prioritize work and balance complex projects
• Ability to work independently and as part of a broader team

Desirable

• Gemini has an exciting opportunity for a Security GRC Senior Associate
• The company seeks to identify a highly proactive and technical individual with proven talent in security process development, policy enforcement, and evidence collection automation
• The successful candidate will work alongside the rest of the GRC team to ensure policies, procedures, and guidelines align with regulatory requirements and security frameworks
• This individual will work with other internal teams to align security goals and objectives with business stakeholders
• Lead Gemini’s effort of rigorous access and entitlement reviews to close identified security gaps
• Conduct consistent partnership and vendor reviews to ensure compliance with security standards
• Review authorized application reviews to ensure compliance with regulatory and reporting requirements
• Support Gemini’s response to Regulators, Auditors, Client inquiries, and Due Diligence Questionnaires
• Support Gemini’s efforts to maintain SOC 2 Type 2, ISO27001, PCI DSS, and other security certifications
• Support Gemini security compliance to NYSDFS Reg. 500, CBI, UK FCA and other regulators
• Support Gemini in automating the evidence collection process for audits
• Support Gemini compliance with NYSDFS Regulation 500
• Automate the enforcement of security requirements to policies, procedures, and guidelines
• Develop tooling to track the organization Cybersecurity Risk and Compliance status
• Develop and implement strategies to audit internal security/cybersecurity controls
• Contribute ideas and suggestions to the team and leadership for additional policies, procedures, and guidelines
• Understand, automate, and regulate internal Identity, Access, and Entitlements Management