Senior Security GRC Architect (Hybrid)

HistoSonics, Inc.; Minneapolis, Saint Paul (MN, MN); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health, dental, vision insurance

401(k) plan

Paid time off and generous benefits

Job summary

HistoSonics, Inc. in Plymouth, MN, is seeking a Principal Security Analyst to lead governance, risk and compliance for the enterprise information security program.

You will own the policy portfolio, maintain the ISMS, map ISO 27001 to the NIST CSF, drive audits, manage third-party risk, and partner with Legal on privacy and data protection. This senior role requires 10+ years in information security, advanced knowledge of ISO 27001 and NIST CSF, and the ability to mentor staff and influence

Qualifications

• Bachelor's degree in a relevant field.
• 10+ years of progressive information security governance, risk, and compliance experience.
• Expert-level working knowledge of ISO 27001 and the NIST Cybersecurity Framework.
• Experience owning an information security policy portfolio or ISMS.
• Experience designing and running a third-party risk management program end to end.
• Experience owning a security training and awareness program.
• Knowledge of privacy requirements (HIPAA, GDPR) and partnering with Legal on privacy matters.
• Technical depth across cloud, IAM, endpoint, network, and application security.

Responsibilities

• Own the organization's information security policy portfolio and ISMS documentation.
• Transition ISMS ownership into the governance organization; manage policy exceptions and risk acceptance.

Skills

Information security governance

Risk management

ISO 27001

NIST CSF

Policy development

Third-party risk

Security training

Privacy & GDPR/HIPAA

Leadership

Education

Bachelor's degree in Information Technology, Information Security, Computer Science, or related field

Tools

ISO 27001

NIST CSF

Job description

HistoSonics, Inc. in Plymouth, MN, is seeking a Principal Security Analyst to lead governance, risk and compliance for the enterprise information security program.

You will own the policy portfolio, maintain the ISMS, map ISO 27001 to the NIST CSF, drive audits, manage third-party risk, and partner with Legal on privacy and data protection. This senior role requires 10+ years in information security, advanced knowledge of ISO 27001 and NIST CSF, and the ability to mentor staff and influence