Staff Security Risk and Policy Engineer

Job Description

The Staff Risk & Policy Engineer is a key contributor in developing and operationalizing Risk Management & Policy Program. 

Brings expertise in process and disciplines in the oversight of cybersecurity-related risks and related policy and governance. The scope of this work is technical risk and control, including our product platform, in-house systems, third-parties, and technical vulnerability management.

This position is key to the assessment of Cybersecurity Risk across Procore's business and technology environments and is essential to ensuring Cybersecurity risks are discovered, visible, and managed. The Staff Risk & Policy Engineer is responsible for documenting the program, fostering awareness and adoption, developing and distributing metrics, and championing ongoing improvements for Procore’s Technical Risk and Policies Programs.

RESPONSIBILITIES

• Perform all responsibilities in accordance with Procore, compliance, regulatory, and cybersecurity  requirements.
• Help to mature the technical risk program, educate the organization about technical risk, and help technical risk owners embrace and use risk assessment and management in their daily activities.
• Contribute to the effort to innovate and automate risk identification, evaluation, registration, and management of issues and findings to establish a comprehensive risk assessment program that results in qualitative and quantitative measures of risk for reporting and remediation tracking purposes.
• Identify, document, and communicate key risks to stakeholders and assist them in developing risk remediation plans.
• Perform reviews to ensure risks are inventoried in a technical risk register, that ownership is taken, and owner engagement is ongoing.
• Develop dashboard designs to communicate status and prioritization of system and business cyber risk to security engineers, risk owners, and executives.
• Support gathering and developing new metrics for risk and policy awareness program reporting. 
• Stay current with changing threats and technology evolution across Procore and implement enhancements and adaptation of Procore's Policies, Standards, and Guidelines in response.
• Establish connections and maintain effective communication with all employees to ensure coordination and exchange of information for accomplishing Risk goals, striving to communicate the responsibility of each employee to own risk, understand technical policies, and strive for the continuous improvement of processes and quality of service.
• Support engagement with Procore staff and management to foster Security Risk training and awareness. Partner with HR, Communications and Business stakeholders as a SME for content development.

QUALIFICATIONS

• Bachelor’s degree in Information Security, Computer Science or related field, or equivalent work experience 
• One of the following certifications, or equivalent certifications, preferred: CISSP, CISM, GIAC, CISA, CRISC, CCSP
• Cybersecurity experience or related experience in GRC, IT, business, or audit.
• Understanding of security frameworks such as ISO 27001, SOC 1 &  SOC 2, NIST 800-171, NIST Cybersecurity Framework, etc.
• Knowledge of cybersecurity practices to advise business and technical teams on security improvements and requirements.
• Ability to collaborate, educate, and influence stakeholder and partner organizations, including third party associates
• Ability to clearly communicate effectively with staff, management, engineers, and auditors.
• Understanding of  cloud software systems
• Working knowledge of the role of firewalls, vulnerability management, penetration testing, server and desktop configuration and controls, and encryption
• Planning, analytical and project management skills
• Ability to work independently, and as a team member, while using sound judgment in problem solving
• Ability to set goals and objectives and willingness to state a case for a direction

Additional Information

Base Pay Range $136,000-$187,000. Eligible for Bonus Incentive Compensation. Eligible for Equity Compensation. Procore is committed to offering competitive, fair, and commensurate compensation, and has provided an estimated pay range for this role. Actual compensation will be based on a candidate’s job-related skills, experience, education or training, and location.

About Us

Procore Technologies is building the software that builds the world. We provide cloud-based construction management software that helps clients more efficiently build skyscrapers, hospitals, retail centers, airports, housing complexes, and more. At Procore, we have worked hard to create and maintain a culture where you can own your work and are encouraged and given resources to try new ideas. C