Information Security & Risk Manager

The Information Security & Risk Manager (ISRM) is an individual contributor responsible for supporting and advancing Empyrean’s information security governance, risk, compliance, and assurance program. The role provides leadership for the ISO 27001 Information Security Management System (ISMS), security risk assessments, control evaluation, policy governance, audit readiness, and remediation activities. The ISRM partners with business, technology, Security, Privacy, and leadership stakeholders to identify, assess, document, monitor, and communicate information security risks and to promote practices aligned with established policies, standards, and control requirements.

ESSENTIAL DUTIES AND RESPONSIBILITIES

Lead Empyrean’s ISO 27001 certification, surveillance, internal audit readiness, and ongoing ISMS compliance activities.

Coordinate ISO 27001 control testing and communications with control owners, business partners, and audit stakeholders.

Support directly or indirectly other assessments and assurance activities, including SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and other applicable frameworks or requirements.

Coordinate and collaborate with Empyrean business units to identify, assess, and communicate risks and control gaps in support of the established control environment and second-line-of-defense (2LoD) oversight.

Partner with business and technology management to develop, implement, track, and validate corrective action and risk-remediation plans.

Manage and coordinate audit and assessment activities related to ISO 27001, SOC, information security, cybersecurity, business applications, and integrated technology controls.

Lead and/or coordinate information security risk assessments associated with major technology initiatives, material environmental changes, third parties, emerging technologies, control exceptions, and other identified risk events.

Support and facilitate recurring security risk and governance meetings, including preparation, documentation, and follow-up activities.

Maintain the enterprise information security risk register and related risk, issue, exception, and remediation documentation.

Provides technical expertise to the teams and uses sound security and compliance practices.

Applies analytical skills to review information and determine potential control weaknesses.

Uses technical and compliance skills to design secure ways to accommodate exceptions to the established security policy in order to support the business.

Participate in meetings with business units and control owners to discuss control requirements, assessment results, risks, and remediation activities.

Partner with Security and Privacy teams to understand the information security and privacy risk profile and apply that knowledge to risk, audit, and assurance planning.

Lead the development and coordination of information security and technology responses for client security questionnaires, RFPs, due-diligence requests, internal inquiries, and related materials; participate in client meetings as a security and risk subject-matter expert when needed.

Partner with security and engineering teams to review, assess, and evaluate the effectiveness of the enterprise cybersecurity threat and vulnerability monitoring and management plan.

Identify gaps in security policies, standards, and supporting documentation and develop or revise documentation to address identified needs.

Maintain and coordinate updates to information security policies, standards, and related governance documentation.

Work cross-functionally on technology initiatives to provide security risk and IT controls expertise, evaluate control design and implementation, and support alignment with established control requirements. Apply knowledge of applicable legal, regulatory, contractual, and privacy requirements when evaluating information security controls.

Work with management and users to interpret the significance of audit findings, conclude on findings, make practical recommendations, and verify that remediation plans are implemented.

Provide cross-functional support to broader information security initiatives, incidents, escalations, and priority projects as business needs require.

Support security roadmaps, business plans, incidents, escalations, and strategic initiatives as needed.

REQUIRED SKILLS AND ABILITIES

Strong communication, presentation, and organization skills

Strong time-management skills and the ability to manage multiple priorities effectively

Ability to effectively engage and work with a variety of roles and teams

Prior security compliance, risk, or audit experience, particularly with ISO 27001; experience with SOC 2, HIPAA, NIST, FedRAMP, or similar frameworks is a plus.

Ability to contribute to cross-functional security, technology, risk, and assurance initiatives.

Strong written and verbal skills with experience preparing work papers, audit reports, and presentations

Strong interpersonal skills with experience dealing with people of various levels of seniority

Working knowledge of information security, technology risk, audit, and control-assurance practices; familiarity with relevant IIA and ISACA guidance is beneficial.

Strong understanding of security and control frameworks, including ISO 27001, SOC 2/TSC, NIST CSF, NIST 800-53, NIST AI RMF, CIS, COBIT, and other applicable frameworks.

Experience with enterprise workflow, ticketing, directory, IT infrastructure, GRC, and security technologies; experience with ServiceNow and Jira is beneficial.

High level of integrity and confidentiality.

Relevant certifications such as CISA, CISM, CISSP, CIA, ISO 27001 Lead Implementer/Lead Auditor, or equivalent are preferred.

KNOWLEDGE, EXPERIENCE AND/OR EDUCATION REQUIREMENTS

5+ years of experience in information security risk, governance, compliance, technology audit, security engineering, or related areas, preferably within a technology or regulated environment.

ISO 27001 Lead Imple