GRC Analyst, Outreach

• 2+ years of building and managing compliance programs including policy definition and control design
• Bachelor’s degree
• Ability to work well within a team atmosphere as well as independently to achieve results within the dynamic Outreach culture
• Hands-on experience managing external auditors and on-site audits including proven experience passing ISO 27001, SOC 2 Type II and HIPAA audits
• Experience in establishing and maintaining compliance in AWS and cloud environments
• Thorough understanding of the latest regulatory requirements and associated security principles
• Excellent interpersonal and management skills
• Strong written and verbal communication skills
• Problem solving skills and ability to work under pressure
• Ability to maintain extreme confidentiality
• Willingness to take on additional responsibilities, as needed

Desirable

• We are looking for a capable security professional to manage the successful completion of our audits, assess our security risks and improve the efficiency of our security controls
• This role blends project management skills together with traditional compliance expertise and a solid information security background together in order to successfully plan for and drive forward these programs
• You will be responsible for helping maintain existing and achieve new accreditations such as ISO 27001, ISO 27701, SOC 2, and HIPAA
• You will collaborate with others across the company to support policy management, participate in our audits, and improve the overall security posture across the company
• You will be working with our GRC, security, and privacy teams, as well as technical leaders and engineers, and our external auditors
• Supporting the Outreach Information Security Management System (ISMS) governance, risk and compliance activities
• Contributing to our GRC strategy to keep pace with Outreach’s rapid growth while reducing audit impact on operational and engineering teams
• Developing and evolving information security policies and helping educate teams of their responsibilities and obligations
• Translating key internal, industry and regulatory obligations including the ISO 27001, ISO 27701, SOC 2 and HIPAA into appropriate administrative and technical controls and educating control owners
• Working with control owners to ensure effective and efficient control monitoring, as well as appropriate visibility of control activity
• Reviewing the operating effectiveness of current controls and developing a program of continual optimization based on feedback from both the ISMS and operational teams
• Extending the control framework to leverage commonalities between multiple assessments and improve the overall efficiency of the Outreach audit program
• Assisting internal teams through the preparation for and successful completion of a variety of key industry and regulatory audits from audit readiness through final assessment including remediation activities
• Helping to coordinate key internal, industry and regulatory audits including ISO 27001, SOC 2, and others
• Ensuring all in-scope functions and teams are prepared for audits
• Assisting with auditor relationships
• Incorporating audit findings and recommendations into the Information Security Management System (ISMS) and Control Framework programs
• Training and communicating responsibilities to control owners including the mapping, review and feedback of controls to specific audit requirements
• Reviewing audit evidence and any findings to assess and improve control effectiveness
• Working with Outreach management teams and engineers to identify and capture security risks and collaborate with risk owners to identify and put effective mitigations and remediations into place
• Ensuring cross company support of all aspects of security by establishing partnerships with other Outreach teams with the overarching goal of improving trust of Outreach and its products
• Demonstrated expertise in managing and ensuring compliance with organizational policies, including the development, implementation, and continuous improvement of policy management systems
• Support in the efforts of our vendor risk management program, including, but not limited to the assessment of, and follow up of governance documentation related to, vendor risk