Senior Compliance Consultant

Essential Duties and Responsibilities

- Lead compliance consulting projects with our clients to guild them on achieving their compliance target (NIST 800-171, SOC 2, etc)

- Perform risk assessments, identify IT controls for significant processes.

- Analyze risk and support risk assessment activities

- Understand technical implementation details necessary to assess security controls

- Participate in the development and oversight of required corrective action plans relating to security compliance issues

- Identify, research, and evaluate new compliance requirements and present them to relevant stakeholders

- Partner with Parachute team members and clients to ensure successful security programs align with compliance requirements

- Assist with aligning and codifying controls to show how they are mitigating information security risk

- Understand the security needs of internal and external stakeholders around external business partners

- Assist with daily activities and functions such as assessing vendors for security risk and provisioning application access

- Managed the information security compliance program, ensuring Parachute IT activities, processes, and procedures meet defined requirements, policies, and regulations.

- Internal and external policy creation and management.

- Managing Parachute’s SOC2 Type2 compliance documentation.

- Assist with managing SOC ticket escalation process.

- Manage vulnerability scan schedules and creating remediation tickets where needed.

Essential Technical Skills and Experience

- Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical internal and external stakeholders.

- Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies.

- Data privacy, compliance, security and project management

- Understanding of risks and internal controls and the ability to evaluate and figure out adequacy and efficiency of controls

- Basic knowledge and understanding of relevant legal and regulatory requirements, such as:

- Sarbanes-Oxley Act (SOX)

- Payment Card Industry/Data Security Standard (PCI)

- Health Insurance Portability and Accountability Act (HIPPA)

- National Institute of Standards and Technology (NIST)

- Cybersecurity Maturity Model Certification (CMMC)

- General Data Protection Regulation (GDPR)

- The California Consumer Privacy Act of 2018 (CCPA)

- Center for Internet Security Controls (CIS)

Requirements

- 5+ years of IT skills with high level of information security experience and expertise

- Knowledge of information security risk management frameworks and compliance practices

- Knowledge of securing network technologies, client, and server operating systems.

- Ability to develop security standards and guidelines based on best practices and industry standards

- Ability to explain technical details to non-technical staff

- Excellent interpersonal, communication, and presentation skills, including formal report writing experience

- Have a love for technology

- Strong desire to be a part of, and contributing to, a high-performing team

- Willingness to learn and teach

- Strong sense of ethics

- GRC certification a plus (GRCP, CRISC, CGRC-IT)