IT SPECIALIST - IT Governance, Risk, and Compliance

Who We Are: SwRI’s cybersecurity mission is to secure the enterprise by evaluating, implementing, and operating a full suite of cybersecurity tools, services, and processes. Objectives of this Role: Compliantly pursue selection, acquisition, and maintenance of technologies. Apply cybersecurity frameworks and policies across the Institute and provide opportunities for remediations. Raise awareness of cyber risks to the Institute through the application of the risk assessment process and report to leadership for risk mitigation. Propose, generate, and review security metrics to demonstrate security progress and opportunities for improvement. Assist in contract review and third-party risk. Daily and Monthly Responsibilities: Evaluating the Institute’s compliance with cybersecurity internal controls and industry frameworks. Authoring and tracking Plans of Actions and Milestones to bring security controls into compliance. Support risk management activities by operating the Institute’s IT risk management process. Assist in developing training, standards, and guidance to support cyber governance processes. Evaluating policy exception requests and make recommendations to the CISO regarding risk reduction and approval. Requirements: Requires a Bachelors degree in Cybersecurity, Information Technology, or related degree with relevant experience. In lieu of a Bachelors degree, 6 years of Cybersecurity and/or IT administration experience an Associates degree or high school education or equivalent and related certifications is required. Certified Information Systems Security Professional (CISSP) preferred. 3 years: Experience auditing IT controls environments or conducting compliance assessments 3 years: Experience in any of various IT and security functions (E.g., IT audit, cybersecurity, IT administration, programming, contracts management, IT GRC) is desirable 3 years: Knowledge of information security standards, E.g., NIST 800-171 or 800-53, CIS Critical Security Controls 3 years: Exposure to/understanding of the fundamentals of network and systems administration (e.g., Windows Server and desktop, Linux, TCP/IP, network subnetting) A valid/clear driver's license is required.