Hybrid IT Security & GRC Lead — Own & Build the Program

Prosum; Irvine (CA); Hybrid; USD 125,000 - 145,000; Full time

Benefits offered by this job

Hybrid work model (2 days onsite)

Annual bonus (up to 10%)

Job summary

Prosum is seeking a hands-on IT Security, Risk & Compliance professional in Irvine, CA. This hybrid role gives you ownership to build and mature our security program as we implement a practical framework.

You will operate the ISMS, manage controls, risk registers, audits, and remediation. Collaborate with internal teams, third-party security partners, and the global parent organization to advance security posture.

Qualifications

• 5+ years of hands-on IT security, risk, and compliance experience.
• Experience with security controls, audits, risk assessments, remediation and testing.
• Familiarity with ISO 27001, NIST, SOC 2 or SOX ITGC.
• Strong documentation, coordination, and communication skills.
• Ability to operate independently in a evolving security program.

Responsibilities

• Own day-to-day operation of the IT security and GRC program.
• Operate ISMS, security controls, risk register, compliance activities, and control calendar.
• Coordinate control testing, access reviews, assessments, audit readiness.
• Gather audit evidence, maintain docs, drive remediation.
• Investigate security incidents and vulnerabilities, coordinate response.
• Collaborate with stakeholders, vendors, and global parent organization.
• Develop and maintain security policies, SOPs, playbooks, narratives.
• Track security awareness and program health.
• Identify opportunities to mature the security program.

Skills

IT Security

GRC

Security Controls

Risk Assessments

Audit & Compliance

Incident Response

Cloud Security

IAM

Tools

ISO 27001

NIST

SOC 2

SOX ITGC

Job description

Prosum is seeking a hands-on IT Security, Risk & Compliance professional in Irvine, CA. This hybrid role gives you ownership to build and mature our security program as we implement a practical framework.

You will operate the ISMS, manage controls, risk registers, audits, and remediation. Collaborate with internal teams, third-party security partners, and the global parent organization to advance security posture.