Maisa AI

Information Security Manager - GRC

Brak informacji o wynagrodzeniu

MidHybryda·ValenciaFull-time·Umowa o pracę

#465136·Dodano 13 dni temu·1

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

SOC 2ISO/IEC 27001ISO 27001:2022ISO 27002 controlsSOC 2 Trust Services CriteriaSMS operation

Podsumowanie oferty

Own and continuously improve Maisa’s security compliance program for its enterprise AI product, serving regulated industries such as banking. Lead SOC 2 Type II and ISO/IEC 27001:2022 audits and certification, and manage broader governance, risk, third-party risk, and customer security reviews.

Wymagania

5+ years of experience in information or cybersecurity, mostly in governance, risk, and compliance.
Practical experience implementing or operating SOC 2 or ISO/IEC 27001 programs, including hands-on work on at least one audit or certification cycle and direct contact with auditors.
Understanding of ISO 27001:2022, ISO 27002 controls, SOC 2 Trust Services Criteria, ISMS operation, risk assessment, and control testing.
Experience designing and documenting controls, not only collecting evidence for controls designed by others.
Hands-on third-party risk management experience, and experience responding to enterprise security questionnaires and client audits.
Understanding of information security governance and processes including identity and access management, secure software development, vulnerability management, incident response, logging and monitoring, business continuity and disaster recovery, employee lifecycle, and security awareness.
Ability to work directly with technical teams and understand their systems well enough to determine whether controls are effective.
Project-management and organizational skills to coordinate control owners across multiple teams.
Excellent written communication skills and ability to produce policies, procedures, risk assessments, audit responses, and executive-level reporting.
Pragmatic approach to distinguishing genuine security and compliance requirements from unnecessary bureaucracy.
Comfortable operating autonomously in a rapidly changing environment and taking ownership of problems through completion.

Nice to have:

Experience leading a SOC 2 audit or ISO 27001 certification cycle end to end.
Experience with compliance automation platforms such as Vanta, Drata, or Secureframe.
Experience in a B2B SaaS or enterprise software company, preferably serving regulated clients such as banks.
Experience with cloud-native environments, particularly AWS and Kubernetes.
Familiarity with GDPR, European information security and privacy requirements, and frameworks such as ISO/IEC 42001, ISO/IEC 27701, or the EU AI Act.
Certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CISM, CRISC, or CISSP, or equivalent.
Experience building or maturing a compliance or ISMS program from an early stage.

Obowiązki

Lead SOC 2 Type II and ISO 27001 programs from readiness through certification and ongoing operation; own audit scope, evidence, auditor and certification-body coordination, surveillance, and renewal.
Shape the certification roadmap as client demand grows; plan audits, budgets, and tooling for additional frameworks.
Run the ISMS day to day, including policies, control ownership, internal audits, and management reviews; turn framework requirements into practical controls with clear owners, tests, and evidence, automating them in the compliance management system where possible.
Coordinate control implementation and continuous assessment across business functions; track milestones and drive findings, exceptions, and remediation through to closure.
Own the company-wide information security and AI risk management process, including the risk register, treatment plans, risk-owner sign-off, and periodic reviews.
Run third-party risk management, including vendor due diligence and assessments, contract security reviews with Legal, and periodic reassessments.
Lead responses to enterprise customer security assessments, due-diligence questionnaires, client audits, and compliance-documentation requests.
Maintain recurring processes and evidence for security awareness, employee compliance, access reviews, incident and change management, business continuity, and secure development.
Work with technical teams to verify control effectiveness across AWS, Kubernetes, identity systems, endpoints, and CI/CD.

Maisa AI

6 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz