Virtual Information Security Officer (vISO)

We are seeking an experienced, highly motivated, and detail-oriented, virtual Information Security Officer to join our team. The primary responsibility of this role is to assist Coretek customers with assessing, establishing, and enhancing the foundation for their Information Security Program. The vISO will work alongside Coretek customers to establish their security, governance, risk, and compliance objectives aligned with their relevant regulatory requirements and information security frameworks and standards. The vISO will also assist customers with their GRC platform implementations and provide advisory for GRC reporting and dashboard utilization. 

Primary Responsibilities:

• General GRC Advisory: Communicate and meet with existing and potential customers to discuss their business objectives and goals around their GRC and Information Security Program buildouts. Establish and facilitate customer workshops to discuss GRC and Information Security strategy.
• Information Security Program Advisory & Development: Provide guidance to the customer on creation or enhancement of the Information Security Program, in accordance with the customer’s business objectives and regulatory requirements. Provide the customer with foundational policies to serve as essential guides contributing to the design of the customer’s Information Security Program.
• Information Security Program Assessments: Perform an assessment of the customer’s existing Information Security Program to identify potential gaps and opportunities for improvement. Generate “findings” reports to provide to and discuss with the customer.
• Regulatory Compliance Readiness Assessments: Perform a readiness assessment of the customer’s Information Security Program. Generate “findings” reports to provide to and discuss with the customer.
• GRC Platform Implementation: Work with the customer to move their existing policies, processes, risk register, etc. into their GRC platform.
• GRC Platform Advisory: Provide guidance to the customer on leveraging the GRC reporting and dashboards for continued improvement of their Information Security Program.
• Ongoing Support: Provide ongoing GRC support to the customer for the continuous improvement and maintenance of the Information Security Program.

Requirements

Qualifications:

• Degree, certification, or training in Computer Science, Information Security, Security Governance, IT Governance, Risk, Compliance, and/or Privacy
• Minimum of 5 years of experience in information security, cybersecurity, audit, or compliance
• Professional certifications such as CMMC-RP, CISSP, CISM, or CISA are highly desirable.
• Experience or familiarity with one or more of the following frameworks: NIST CSF, NIST 800-171, ISO 27001, NIST 800-53, FedRAMP/StateRamp, SOC 2 Type 2, CMMC, HITRUST, HIPAA/HITECH, and GDPR.
• Ability to conduct research and stay current on relevant frameworks and standards.
• Ability to collaborate with individuals across the customer organization.
• Project and time management skills, with the ability to prioritize and manage multiple engagements effectively.
• Experience or familiarity with GRC technology services or applications.
• Strong analytical, problem-solving, and decision-making skills.
• Ability to work both independently and collaboratively in a fast-paced, dynamic environment.
• Experience with Microsoft O365 applications (Word, Excel, SharePoint)
• Proficiency in creating both detailed and summary reports for clients, as it pertains to the requirements of the engagement.
• Utilize excellent English speaking and written communication skills to articulate clearly and effectively with teammates and customers, where applicable; additional language proficiency is a plus.