Information Security Governance Compliance Analyst

RESPONSIBILITIES

Kforce has a client that is seeking an Information Security Governance Compliance Analyst in Foster City, CA.

Summary

We are seeking a highly skilled Information Security Governance Compliance Analyst who will be responsible for ensuring that the organization adheres to established information security governance, risk management, and compliance (GRC) frameworks. This role involves conducting internal compliance assessments, risk assessments, and ensuring adherence to policies and standards. The Analyst will work closely with various departments to ensure compliance with frameworks such as NIST 800-53, NIST CSF 2.0, ISO 27001, ISO 21434, and other relevant standards.
In this role you will be engaged in the following areas:

• Develop and implement security management systems to track objectives and controls
• Plan and lead organization-wide security audits to ensure compliance with relevant policies, standards, and frameworks (e.g. NIST 800-53, ISO 27001, NIST CSF 2.0 etc.)
• Coordinate internal and external audits with IT, Product Security, and other departments/teams
• Prepare, review, and maintain compliance documentation
• Conduct risk exposure assessments to identify potential threats and vulnerabilities
• Perform comparative risk assessments to evaluate different solutions and their impact on security
• Prioritize risks based on their potential impact and likelihood, determining security ROI for prioritization considerations
• Develop and implement remediation plans for identified risks
• Ensure compliance activities align with existing policies, standards, frameworks, and industry regulations
• Identify and address shortcomings in platform security and compliance processes
• Develop and maintain the control framework, ensuring it is up-to-date and effective
• Serve as a liaison between IT and internal auditing teams
• Work with various departments to ensure compliance with internal and external requirements

REQUIREMENTS:

• Bachelor's degree in Computer Science, Information Systems, Business, or a related field, or equivalent relevant experience
• Certifications (beneficial): Professional certifications such as CISA, CISM, CRISC, CISSP
• L5 candidates would be expected to have 8+ years of relevant experience
• 5+ years of experience in conducting security control assessments or audits
• 5+ years of experience with information security standards and privacy laws (e.g., ISO 27001, NIST, GDPR, CCPA, CPRA, etc.)
• Strong knowledge of GRC frameworks and tools
• Proficiency in risk assessment methodologies and tools
• Hands-on familiarity with the following - you don't need to be an expert, but you should be comfortable working with them: LLMs (Large Language Models), AI (artificial intelligence), ML (machine learning) security management tools (e.g., vulnerability scanners, file integrity monitoring, configuration monitoring, etc.) and perimeter technologies (e.g., router, firewalls, web proxies and intrusion prevention, etc.)
• Excellent analytical and critical thinking skills
• Strong written and verbal communication skills
• Ability to work collaboratively in a dynamic, fast-paced environment
• Experience in automotive, aerospace, industrial control systems (ICS/SCADA), or high-assurance environments is beneficial, but not required

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.
We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law. This job is not eligible for bonuses, incentives or commissions. Kforce is an Equal Opportunity/Affirmative Action Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status. By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

You will always have the right to cease communicating via text by using key words such as STOP.