Vendor Security Specialist

Granite Solutions Groupe, Inc.; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision

Company-paid life insurance

401(k) retirement plan

Commuter benefits

Job summary

Granite Solutions Groupe, Inc. is seeking a Senior Consultant, Cybersecurity to lead security contract negotiations, regulatory analysis, and third-party security assessments for large financial industry clients.

You will work with GIS leadership, legal, and vendor executives to manage DSA modifications, map regulatory requirements to policy, and drive security controls across complex vendor relationships. Strong communication to senior leadership is essential.

Qualifications

• 7+ years of industry experience in security contract negotiations and third-party security assessments.
• Experience applying cyber security policies and controls to third-party contracts.
• Familiarity with NIST CSF, ISO 27001, and related regulations.

Responsibilities

• Develop understanding of the Data Security Addendum (DSA) for third-party contracts.
• Analyze third-party DSA modifications and propose acceptable language.
• Negotiate DSA modifications with third parties with GIS leadership and legal.
• Communicate security impact and update GIS leadership on status.

Skills

Security negotiations

Regulatory analysis

Third-party security

Executive communication

Stakeholder management

Risk assessment

Education

Bachelors CS/related

Tools

MetricStream

RSA Archer

OneTrust

Job description

Senior Consultant, Cybersecurity

About Our Firm:

Granite Solutions Groupe provides financial services decision makers with people and solutions that deliver. Our clients count on us to deliver the right talent at the right time to achieve critical business results. We leverage our industry knowledge and passion for client priorities to deliver human capital solutions.

GSG was founded in 1998 as a consulting firm delivering project management and technology solutions for the financial services industry. GSG now has a global presence, with team members deployed across the U.S. at Fortune 1000 companies and high-performing Fintech firms.

High-caliber consultants are the face of GSG at our client organizations and offices. We value the deep relationships we have with our consultants that enable us to place them in roles where their skills will have an immediate impact. The GSG consulting team is comprised of diverse, experienced, driven, and dynamic contributors who excel at getting things done.

About the Opportunity:

We are seeking a talented and passionateSecurity Contracts/Regulations and Third Party Security Specialist – GIS Governance, Risk & Compliance Consultant.

Responsibilities:

Security Contracts Responsibilities:

• Develop a deep understanding of the company's Data Security Addendum (DSA) for third-party contracts.
• Analyze third party modifications to the company's DSA and:
  • Develop/document a position on acceptable versus unacceptable modifications.
  • Propose alternative language that is acceptable to GIS leadership.
• Work closely with GIS leadership, legal, and third party relationship executives to:
  • Communicate the security impact to FT of third-party DSA modifications.
  • Effectively engage senior business and IT stakeholders with polished executive communication.
  • Negotiate DSA modifications with third parties to the extent permissible by GIS leadership and legal.
• Participate in conference calls as needed to finalize the DSA.
• Propose periodic updates to the DSA based on lessons learned from third party negotiations, emerging regulatory third-party security oversight requirements, and the evolving security threat landscape

Security Regulations Responsibilities:

• Research, monitor and analyze updates to existing international cybersecurity regulations and emerging/new cybersecurity regulations.
• Track regulations manually, map requirements to the company’s Security Policy and Security Program and Framework and identify misalignments.
• Propose updates to the company's Corporate Information Security Policy and Security Program and Framework based on identified misalignments.
• Document/Communicate the results to GIS leadership.
• Monitor industry wide Cybersecurity threat landscape for emerging threats
• Propose potential additional updates tothe company's Corporate Information Security Policy and Security Program and Framework that may be needed to address emerging threats.

Third Party Security Responsibilities:

• Conduct vendors security assessments for compliance with our firm’s information security policies, standards, and controls.
• Identify vendors security issues/non-compliance and recommend appropriate remediation activities to resolve them.
• Engage vendors IT and Cybersecurity leadership to further investigate identified security risks and negotiate their resolution.
• Communicate status/progress to business stakeholders.

Requirements:

• Overall 7+ years of industry experience in security contract negotiations, security regulations research/analysis, and third-party security assessments for large global financial organizations and their Cybersecurity teams.
• Deep experience in applying knowledge of Cybersecurity policies, Cybersecurity standards, Cybersecurity controls, Cybersecurity programs and frameworks to third party security contract negotiations and international cybersecurity regulations.
• Experience with NIST CSF, ISO 27001, NIST 800.30, FFIEC, and SEC Regulation S-P industry standards, frameworks, and regulations for Information Security.
• Subject Matter Expertise in using the Standard Information Gathering Questionnaire (SIG) to conduct third party security assessments.
• Experience with evaluating SOC reports, ISO 27001 certifications, and other internationally recognized independent attestations for evaluating third party security controls.
• Proven expertise in related security domains (e.g., security risk assessments, audits, controls definition/testing, etc.).
• Comfortable collaborating with Business and Cybersecurity leadership on security contract risks, third-party security assessment risks, and negotiating their resolution.
• Experience in IT Governance, Compliance, and Risk management processes and tools (MetricStream, RSA Archer, OneTrust or similar eGRC platforms).
• Bachelor’s degree in Computer Science, Computer Information Systems, or an equivalent combination of education, certifications, and experience.
• Proficient use of Microsoft Outlook, Microsoft Teams, Microsoft SharePoint, and Microsoft Office 365.
• Preferred professional qualifications with certifications (CISSP, CISA, CISM, CRISC, etc.).
• Strong contract negotiation skills.
• Problem solving/analytical skills, research skills, and technical aptitude.
• Exceptional executive presence and ability to communicate complex security topics to senior leadership.
• Good interpersonal skills, team participation skills, and a positive work ethic.
• Exceptional attention to detail.
• Able to multitask and prioritize effectively.
• Effective partnership & collaboration.

Employee Benefits:

• GSG is excited to offer its consultants excellent compensation and a robust option of benefits which include comprehensive medical, dental, vision and prescription coverage.
• You will receive company-paid life insurance.
• In addition, we hope you will take advantage of eligible commuter benefits-like paying for work-related public transit and parking with pre-tax dollars.
• Save for your retirement with pre-tax contributions that go directly into your 401K.
• We also care about your pets with several options for pet insurance, discount card and prescriptions.

GSG’s Commitment to Diversity:

As a diverse-owned business, GSG is committed to creating a diverse workforce, and we are proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.