Sr. GRC Specialist

Neptune Technology Group; Duluth (GA); On-site; USD 100,000 - 150,000; Full time

Job summary

A technology company specializing in water utilities is seeking a Sr. GRC Specialist focused on Product and Application Security. This role involves ensuring compliance with security standards and integrating security practices throughout the product lifecycle. The ideal candidate will have a Bachelor's degree in a relevant field, 5+ years of experience in governance, risk, and compliance, and strong analytical and communication skills. The position is based in Duluth, GA, with minimal travel required.

Qualifications

• Minimum of 5+ years of relevant experience in governance, risk, and compliance roles.
• Strong understanding of regulatory requirements and industry standards.
• Certifications such as ISO 27001, CISA, CISM, or CISSP.

Responsibilities

• Integrate security requirements into the product design phase for software and IoT products.
• Conduct security reviews and assessments of products and applications.
• Lead incident response efforts for product and application security incidents.
• Develop and maintain security policies, standards, and procedures.
• Perform threat modeling and risk-based decision making for products.
• Coordinate incident response, investigation, remediation, and reporting.

Skills

Analytical & Problem-Solving

Communication & Leadership

Attention to Detail

Technical Expertise

Independent decision making

Education

Bachelor’s degree in information systems, Cybersecurity, or a related field

Tools

Cybersecurity tools

Microsoft Office Suite

GRC platforms

Job description

Neptune Technology Group Inc. is a technology company serving water utilities across North America. Since 1892, we have continually focused on the evolving needs of water utilities – revenue optimization, operational efficiencies, and improved customer service. With our portfolio of smart water meters, data collection systems and software, we make data actionable for our customers – so they can remain focused on the business of water. For additional information, please visit the company website at www.neptunetg.com.

About the Role

As a Sr. GRC Specialist focused on Product and Application Security, you will be responsible for ensuring that Neptune Technology Group's products and applications adhere to the highest security standards. You will engage with stakeholders throughout the organization and the product lifecycle to ensure that security practices are followed, and risk mitigations are implemented where required.

Responsibilities

• Application and Product Security: Integrate security requirements into the product design phase for software, and IoT/IIOT products. Ensure secure coding practices are followed and conduct regular security assessments of applications to identify and mitigate vulnerabilities. Conduct security reviews and audits to ensure compliance with industry standards.
• Security Standards: Develop and maintain application and product security policies and procedures. Develop, implement, and maintain security standards and best practices for product and application security.
• Security Reviews: Conduct security reviews and assessments of products and applications to identify potential vulnerabilities and ensure compliance with security standards.
• Security Tools & Processes: Implement and manage security tools and processes, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and penetration testing.
• Threat Modeling: Perform threat modeling to identify and mitigate potential security risks in products and applications.
• Incident Response: Lead incident response efforts for product and application security incidents, including investigation, remediation, and reporting.
• Training & Awareness: Develop and deliver training and awareness programs to educate stakeholders on product and application security best practices.
• Risk Assessments: Conduct risk assessments and develop mitigation strategies for identified security risks.
• Collaboration: Collaborate with cross-functional teams, including development, operations, and legal, to ensure security requirements are integrated into the product development lifecycle.
• Documentation: Maintain comprehensive documentation of security assessments, reviews, and incident response activities.

Qualifications

• Bachelor’s degree in information systems, Cybersecurity, or a related field.
• Minimum of 5+ years of relevant experience in governance, risk, and compliance roles.
• Strong understanding of regulatory requirements and industry standards.

Preferred Skills

• Certifications such as ISO 27001, CISA, CISM, or CISSP.
• Experience with third-party risk management and vendor assessments.
• Knowledge of security frameworks such as ISO 27001, NIST, SOX or SOC 2.

Required Skills

• Analytical & Problem-Solving: Strong analytical skills with the ability to identify risks and propose effective solutions.
• Communication & Leadership: Excellent communication skills with experience leading cross-functional teams and working with senior management.
• Attention to Detail: Meticulous attention to detail in reviewing audit findings, compliance risks, and policy documentation.
• Technical Expertise: Proficient in cybersecurity tools, and Microsoft Office Suite. Knowledge of GRC platforms is a plus.
• Ability to work independently and make decisions with wide latitude for independent judgment.

Pay range and compensation package

Typically require overnight travel less than 10% of the time. Location: Duluth, GA or Tallassee, AL.

Equal Opportunity Statement

We are committed to diversity and inclusivity.