Nhyira A Email & Phone Number

• Participate in various department projects as a GRC representative to provide GRC guidance and interpretation of policies, standards, regulations, risks, and best practices.• Manage exception program to ensure continuous compliance of internal policies and industry control frameworks.• Evaluate exceptions via identifying the non-compliance of why an exception is needed, risk profile, identifying compensating controls to help mitigate the risk.• Work with stakeholders through the exception process including finalizing reports with recommendations based on the risk and compensating controls available.• Share finalized reports with GRC Director and CISO for their final approval of the exceptions.• Monitor and track exceptions to ensure permanent controls are put in place and work with stakeholders if an extension is needed based on business need.• Conduct thorough due diligence and vendor reviews on print partners and third-party service vendors.• Perform internal security assessment to ensure compliance to the various frameworks including SOC, ISO etc.• Create, implement, and manage policies, standards, procedures, training and communication of the new policies, standards, and procedures to support projects and adherence.• Strong understanding of various compliance and regulatory areas SOC 2 Type 2 and ISO 27001.• Managed annual cyber security and awareness training and facilitated new hires security training.• Manage risk incidents, risk register, and risk reporting.• Communicate identified risks to key stakeholders including control owners, policy, and standard owners to initiate and implement risk remediations.• Review Risk management Plans with Business Partners to ensure no violations toPHI, SPI, PI, PII and required risk treatments are in place• Perform control mappings and ensure control artifacts are documented incompliance with SOC 2 Type 2 and ISO 27001.

Remote

• Perform detailed Assurance Assessments through execution of quarterly, biannual, and periodic assessments and quality assurance reviews.• Manage project activities for performing assessments, developing strategies, and implementing Identity and Access Management solutions.• Develop, document and maintain information security identity and access control strategy and operational procedures, processes and guidelines.• Identify any industry standard violations, communicate with senior management and leaders of the violation(s) and provide detailed report including any identified exceptions and remediation action plans.• Develop and review system security control artifacts for compliance with NIST 800 guidelines and agency’s security requirements.• Ensure compliance for information security solutions, controls, tools, and techniques by leveraging current and new capabilities/processes that governs and protects the company’s assets.• Facilitate the development, documentation, implementation, communication and maintenance of identity and Access management program, standards, policies, controls, procedures, processes and reports.• Evaluate vendor solutions (IaaS, SaaS, CaaS) to ensure compliance to agency’s policy, procedures, regulatory frameworks, and privacy to implement applicable access management options such as single sign-on (SSO), multi-factor authentication (MFA), separation of duties, privileged account management, role-based access control etc.• Assist with security documentation such as Risk Assessments, Incident Response Plans, Change Control procedures, and Standard of Operation and Procedures(SOP).• Connect with team across technology to identify needs to build Identity and Access control into solutions and technologies.• Review Risk management Plans with Business Partners to ensure no violationsto PHI, SPI, PI, PII and required risk treatments are in place

• Assist with security documentation such as Risk Assessments, Incident Response Management, Change Control procedures and Standard of Operation and Procedures (SOP).• Responsible for researching and evaluating relevant information security policies, guidance, and best industry practices for applicability to IT systems security.• Monitor controls post authorization to ensure continuous compliance with the security requirements by evaluating threats and vulnerabilities through Nessus scan results and work with the IT and Security staff for mitigation actions.• Conduct walkthroughs; formulate test plans, documented gaps, test results,and exceptions.• Perform IT operating effectiveness tests in the areas of security, operations, change management, and email authentication.• Develop the audit plan and performed the General Computer Controls testing of Information Security, Business Continuity Planning, and Relationship with Outsourced Vendors.• Assist with walkthroughs and held meetings with the client to discuss areas to be tested: Access, Risk Management, Configuration Management, Identity and Access Management, Incident Response, Contingency Planning, and Security training• Review implementation statements and supporting evidence of security controls as to determine if the systems are currently meeting the requirements and provide findings/suggested mitigations to stakeholders.• Update and maintain all document control to comply with ISO Management.• Responsible for administering and conducting all monthly, quarterly and yearly internal and external audits.• Maintain and manage master copies of all policy standards, operational procedures, work instructions and all other documents.• Train deputy trainers to assist in conducting internal audits to ensure compliance and discover gaps in processes.