[Hiring] Senior Security Advisory & GRC Consultant @Apptad, Inc.

Role Description

Conduct outsourced third-party risk assessments, light solution architecture reviews, and GRC risk modeling for enterprise web applications and plug-in integrations.

Key Responsibilities

• Application & Solution Architecture Vetting:
  • Perform light-touch architectural and security reviews for incoming business-requested web applications and third-party SaaS integrations.
• Risk & Control Mapping:
  • Establish and manage a "Shared Responsibility Matrix" for evaluated solutions, identifying key operational, technical, and high-level legal/contractual risks based on standard criteria.
• Business & Cost Evaluation:
  • Help evaluate business case feasibility, overall cost structures, and risk acceptance models on behalf of client stakeholders.
• Third-Party Risk Scoring:
  • Work with third-party risk rating platforms (e.g., BitSight, SecurityScorecard) to generate risk scores and executive summaries.
• Risk Acceptance & Governance:
  • Assist client leadership in drafting risk acceptance documentation and defining clear risk ownership.

Qualifications

• 10+ Years in Information Security:
  • Background spanning Security Architecture, Governance, Risk, & Compliance (GRC), and Application Security (AppSec).
• GRC & Framework Expertise:
  • Deep understanding of NIST CSF, ISO 27001, SOC 2, and SaaS/Cloud Security Shared Responsibility Models.
• Third-Party Risk Management (TPRM):
  • Hands-on experience conducting third-party vendor risk assessments and utilizing tools like BitSight, SecurityScorecard, or dedicated GRC platforms.
• Executive Communication:
  • Ability to translate complex technical/security risks into clear business terms for CIOs, CISOs, and business unit leaders.
• Certifications (Preferred):
  • CISSP, CISA, CRISC, CISM, or CCSP.