ESSENTIAL DUTIES/RESPONSIBILITIES:

Framework Compliance – SOC 2 & ISO 27001:

• Own and manage the organization's SOC 2 (Type I & II) and ISO 27001 compliance programs end-to-end, including control design, evidence collection, gap assessments, and remediation tracking.
• Serve as the primary point of contact with external auditors and certification bodies; coordinate audit readiness activities and ensure timely responses to audit requests.
• Maintain and continuously improve the Information Security Management System (ISMS) in alignment with ISO 27001 requirements.
• Monitor the regulatory and standards landscape for updates to SOC 2 Trust Services Criteria and ISO 27001:2022 and translate changes into actionable program updates.
• Develop, review, and maintain information security policies, standards, and procedures that satisfy framework requirements.
• Track and report on control effectiveness metrics, audit findings, and remediation status to the CISO and senior leadership.

• Plan, schedule, and facilitate Information Security Committee meetings, including agenda preparation, material distribution, minute-taking, and action item tracking.
• Coordinate cross-functional participation in governance bodies (e.g., Risk Committee, Change Advisory Board) and ensure security representation and follow-through.
• Prepare governance dashboards, risk registers, and Key Risk Indicator (KRI) / Key Performance Indicator (KPI) reports for committee review.
• Drive accountability across business units by tracking and escalating open security action items through appropriate governance channels.

• Support the CISO in the development, execution, and reporting of the annual information security roadmap and strategic plan.
• Maintain the security program portfolio, including project status, milestones, dependencies, risks, and resource utilization.
• Contribute to security initiatives such as vulnerability management, third-party risk management, security awareness training, and incident response planning.
• Develop and maintain a security metrics program that provides visibility into the health and maturity of the information security function.
• Support budget planning and vendor management activities relevant to security tools, assessments, and services.
• Identify and evaluate unsanctioned or emerging AI tool use across the organization (shadow AI), and support processes to assess and approve AI applications in alignment with security and privacy requirements.
• Track developments in the AI risk and regulatory landscape — including the NIST AI Risk Management Framework (AI RMF) and emerging AI-specific regulations — and surface implications for the security program to the CISO.

• Act as the embedded security resource and advisor for internal project teams throughout the project lifecycle, from initiation through closure.
• Conduct security reviews and risk assessments for new projects, system changes, and technology implementations; provide documented risk guidance and approval recommendations to project managers.
• Ensure security requirements are captured and tracked in project plans, and that security sign-off is obtained prior to production releases.
• Participate in project steering committees and sprint reviews as needed to surface and address security risks in a timely manner.
• Serve as a liaison and coordination point between CISO’s office and internal security disciplines, including Security Architecture, Risk and Compliance, and Cybersecurity Operations, ensuring alignment on priorities, initiatives, and program goals.
• Partner with Security Architecture to ensure new designs and technology decisions incorporate security requirements and comply with established frameworks and policies.
• Work closely with the Risk and Compliance to align risk assessment activities, control mapping, and audit evidence with the broader enterprise risk management program.
• Coordinate with Cybersecurity Operations on threat monitoring, incident escalation procedures, and operational security metrics, ensuring operational insights inform the program's strategic posture.
• Collaborate with Security Architecture and Cybersecurity Operations to assess and address AI-specific threat vectors — including prompt injection, model poisoning, adversarial inputs, and AI-enabled social engineering such as deepfakes — as the organization adopts AI-powered tools and services.
• Collaborate with other departments — including Legal, HR, IT, Product, and Finance — to embed security requirements into business processes, contracts, and organizational change activities.
• Act as an extension of the CISO within cross-functional forums, representing the security organization's position and priorities while facilitating productive working relationships across teams.

• Respond to customer security questionnaires, due diligence requests, and RFP security sections in an accurate, professional, and timely manner.
• Serve as a subject-matter expert during customer security reviews, audits, and contract negotiations, working closely with Sales, Legal, and Account Management.
• Maintain and continuously improve a customer-facing security trust package (e.g., security overview, FAQs, certifications, penetration test summaries).
• Build and nurture positive relationships with customer security teams, fostering trust and demonstrating the organization's commitment to data protection.
• Incorporate AI-related security considerations into customer due diligence responses and vendor assessments, including evaluating how third-party AI vendors handle customer data, model training practices, and associated contractual protections.

• Provide direct coordination and strategic support to the CISO, including preparing briefings, board presentations, and executive reports.
• Monitor the threat intelligence landscape and summarize relevant developments for CISO review and communication to senior leadership.
• Oversee and coordinate the security awareness and training program.
• Support the development and testing of the Incident Response and Business Continuity plans, ensuring Business Impact Analysis facilitates cyber tabletop exercises.
• Collaborator in third-party and vendor risk assessments, ensure an efficient and security proficient process is support.
• Stay current on emerging security trends, regulations, and industry best practices; recommend program enhancements as appropriate.
• Coordinate with Legal and Privacy teams on data protection implications of AI adoption across the organization, including risks associated with PII exposure in AI prompts, outputs, and third-party model training pipelines.

• Other duties as assigned by supervisor. These may, on occasion, be unrelated to the position described here.