ISO 27001 InfoSec & Risk Leader

Colonial Group; Houston (TX); On-site; USD 120,000 - 160,000; Full time

Job summary

Empyrean is seeking an Information Security & Risk Manager (ISRM) to lead governance, risk, compliance, and assurance programs. The role focuses on ISO 27001 ISMS, risk assessments, policy governance, audit readiness, and remediation activities, partnering with business units and leadership.

As an individual contributor, you will coordinate with Security, Privacy, IT, and Leadership to identify risks, document controls, and drive remediation.

Qualifications

• 5+ years of experience in information security risk, governance, compliance, or related areas in tech or regulated environments.
• ISO 27001 Lead Implementer or Lead Auditor training and/or certifications such as CISA, CISM, or CISSP preferred.
• Strong knowledge of security frameworks (ISO 27001, SOC 2/TSC, NIST CSF, NIST 800-53, CIS, COBIT) and risk assessment practices.
• Experience with audit, policy governance, and remediation planning.

Responsibilities

• Lead ISO 27001 certification, surveillance, and ISMS compliance activities.
• Coordinate ISO 27001 control testing with owners, partners, and audit stakeholders.
• Support assessments including SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and others.
• Coordinate with business units to identify and communicate risks and remediation priorities.
• Develop, implement, and track corrective actions and risk remediation plans.
• Maintain enterprise risk registers and related governance documentation.
• Prepare information security responses for client security questionnaires and RFPs.

Skills

Communication skills

Time-management

Cross-functional collaboration

Audit readiness

Security risk management

Policy governance

Presentation skills

Interpersonal skills

Education

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor training

CISA

CISM

CISSP

Tools

ServiceNow

Jira

Job description

Empyrean is seeking an Information Security & Risk Manager (ISRM) to lead governance, risk, compliance, and assurance programs. The role focuses on ISO 27001 ISMS, risk assessments, policy governance, audit readiness, and remediation activities, partnering with business units and leadership.

As an individual contributor, you will coordinate with Security, Privacy, IT, and Leadership to identify risks, document controls, and drive remediation.