ISO 27001 Security Risk Lead

Empyrean Benefit Solutions; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

Empyrean Benefit Solutions is seeking an Information Security & Risk Manager (ISRM) to advance its information security program. This role leads ISO 27001 ISMS, risk assessments, control evaluations, policy governance, and audit readiness across the organization.

You will partner with business, technology, Security, Privacy, and leadership teams to identify and communicate risks, develop remediation plans, and ensure compliance with frameworks such as ISO 27001, SOC 2, NIST CSF, and HIPAA.

Qualifications

• 5+ years of experience in information security risk, governance, compliance, or related areas.
• ISO 27001 Lead Implementer or Lead Auditor training and/or relevant certifications.
• Working knowledge of NIST CSF, SOC 2/TSC, CIS, ISO 27001/ISMS, COBIT, ITIL.
• Experience with vulnerability management, incident response, and security controls.
• Strong understanding of cybersecurity processes and technology concepts.

Responsibilities

• Lead ISO 27001 certification, surveillance, and ISMS compliance activities.
• Coordinate ISO 27001 control testing and communications with control owners and audit stakeholders.
• Support SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and other frameworks.
• Develop and communicate risk remediation plans with business and technology teams.
• Lead information security risk assessments for major initiatives and third parties.
• Maintain enterprise information security risk registers and remediation docs.

Skills

Security risk assessment

Communication

Stakeholder engagement

Cross-functional collaboration

Audit readiness

Project/time management

Education

ISO 27001 Lead Implementer/Auditor

Bachelor's degree

Tools

ServiceNow

Jira

GRC tools

Job description

Empyrean Benefit Solutions is seeking an Information Security & Risk Manager (ISRM) to advance its information security program. This role leads ISO 27001 ISMS, risk assessments, control evaluations, policy governance, and audit readiness across the organization.

You will partner with business, technology, Security, Privacy, and leadership teams to identify and communicate risks, develop remediation plans, and ensure compliance with frameworks such as ISO 27001, SOC 2, NIST CSF, and HIPAA.