Evaluate and implement security controls based on frameworks such as NIST, CIS, HIPAA, SOC 2, and HITRUST.Develop and maintain policies, procedures, and documentation (controls, narratives, matrices).Lead SOC 2 and HITRUST audit engagements, from audit planning through remediation.Coordinate and monitor third-party risk assessments and compliance reviews.Own and lead BCP (Business Continuity Planning) and BIA (Business Impact Assessments) efforts.Build and maintain security risk registry
Perform audit readiness assessments, and support internal/external audits.Partner with external auditors, control owners, and leadership to minimize business disruption.Track and drive remediation plans based on audit findings and compliance gaps.Maintain and communicate exception documentation for policy deviations.Educate and guide control/risk owners on their responsibilities.
Advisory & Communication:
Act as a liaison between technical and non-technical stakeholders.Respond to security questionnaires, RFIs, and client compliance inquiries.Develop and deliver security awareness and training programs.Provide executive reporting on program status, risks, and overall health.