[Hiring] Program Manager-Security Operations & Compliance @Anovia

Role Description

Anovia is looking for a hands-on information security and compliance professional with practical experience working with ISO/IEC 27001, SOC 2, HIPAA, or similar security and compliance programs. The successful candidate will have experience helping an organization prepare for and work through an audit or certification process, including:

• Developing and maintaining policies and controls
• Supporting evidence collection
• Coordinating activities and meetings
• Tracking actions
• Working with internal and external auditors

This is also a build and delivery role. Anovia has a number of technical and operational initiatives that require more structure, planning, coordination, and follow-through. The successful candidate will be comfortable taking an initiative that is not yet well defined, establishing a practical plan, coordinating the people involved, and driving the work through to completion. Examples could include:

• Implementing a new security tool
• Improving security monitoring or vulnerability management
• Helping establish a NOC/SOC capability

Qualifications

• 4+ years of progressively responsible experience in information security, IT compliance, GRC, security operations, or a related field.
• Practical experience working with ISO/IEC 27001, SOC 2, or a comparable security and compliance framework.
• Experience with GRC processes and tools, including risk and control management.
• Working experience with the Microsoft 365 security environment.
• Demonstrated ability to take an ambiguous technical or operational initiative and bring structure to it.
• Working knowledge of information security principles, risk management, access control, vulnerability management, incident response, and security awareness.
• Comfortable working directly with auditors, technical teams, business stakeholders, vendors, and leadership.
• Strong organizational and communication skills.
• Bachelor's degree in Information Security, Computer Science, IT, or a related field, or equivalent practical experience.

Requirements

• Experience helping an organization prepare for and work through an audit or certification process.
• Familiarity with activities such as policy development, control implementation, evidence collection, audit preparation, management meetings, action tracking, and remediation.
• Experience with HIPAA Security and Privacy Rule requirements or other healthcare security and privacy requirements (nice to have).
• Experience with GRC platforms such as Secureframe, Vanta, Drata, or OneTrust (nice to have).
• Experience with SIEM, EDR/endpoint protection, vulnerability scanners, or related security tooling beyond the Microsoft 365 environment (nice to have).
• Experience with NIST CSF or other complementary security frameworks (nice to have).
• Experience managing contractors or vendors during technical or security initiatives (nice to have).
• Experience helping establish or improve security monitoring, NOC, SOC, or similar operational capabilities (nice to have).
• Experience with business continuity and disaster recovery planning (nice to have).

Benefits

• Comprehensive Health Insurance policy
• Employee Wellness Program with focus on mental health
• Robust reward and recognition programs
• Company incentive programs offered
• Attractive leave policy: Holiday Leave, Maternity Leave, Paternity Leave, Birthday leave, Bereavement Leave and Paid Leave for personal time off
• Ample growth and learning opportunities
• Remote work opportunities
• Focus on work/life balance
• Immigration Program supporting immigration to Canada for eligible employees

Certifications

• ISO/IEC 27001 Lead Implementer or Lead Auditor
• CISA (Certified Information Systems Auditor)
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• Relevant certifications are preferred but not required