IT Security Risk Management Analyst (Policy Reviewer & Policy Writer)- SOC or ISO or NIST + Audit
Core
Perform security-focused evaluations of governance, risk, and compliance for IT assets, third-party suppliers, and clients; develop and maintain information security policies aligned with frameworks like ISO 27001, NIST, and HIPAA.
Role type
Senior IC IT Security Risk Management Analyst (Policy & Audit)
Builds
Security control compliance reports, policy documentation, and audit remediation plans for life sciences clients.
Domain
Life Sciences / Healthcare / Information Security
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
Third-party risk assessment, Security control auditing (SOC 1/2, ISO 27001), Policy lifecycle management, Regulatory compliance analysis, Risk treatment planning, Technical writing
Preferred skills
CISA, CIA, CRISC, TPCRA, ISO 27000 Internal Auditor, Open FAIR, Quantitative risk assessment (FAIR)
Technologies
ISO 27001, NIST 800-53, HIPAA, PCI DSS, SOC 1, SOC 2
Responsibilities
Review and update information security policies and standards; Conduct security assessments on third-party suppliers and clients; Facilitate SOC 1, SOC 2, and HIPAA audit activities and remediation; Develop threat models and risk assessments for business lines; Draft reporting for senior leadership on security posture.
Seniority
Mid-Senior, hands-on IC