GRC Controls Consultant | Full Time | Remote

GENERAL SUMMARY:

This position reports to the Manager of Cybersecurity Controls Management within the Cybersecurity Governance, Risk, and Compliance (CGRC) organization and collaborates closely with cross functional enterprise groups to ensure processes and services are implemented and operationalized to meet both the needs of the business and regulatory requirements.

PRINCIPLE DUTIES AND RESPONSIBILITIES:

Responsible for the design and implementation of assigned programs in support of the Cybersecurity Controls strategic roadmap. The position requires technical and operational knowledge of information security, audit, and risk best practices, as well as legal and regulatory compliance requirements that impact privacy and security or introduce risk for the enterprise. The position will support HFH as well as its subsidiaries.

Must have the ability to develop work with minimal supervision, maintain and report against a work plan, give appropriate updates and status reports, and serve as a point of contact and liaison with internal and external auditors, assessors, vendors and clients and assist other staff members.

• Support the Governance Risk and Compliance (GRC) system workflow processes (ex. Control Management, Continuous Monitoring, Control Self-Assessment, Issue Management, Policy Workflow, GRC system updates and testing).
• Assist in the facilitation of the GRC Controls Management program (Data entry, issue monitoring, reporting, governance reporting, escalation processes, 
  managing MS team site access).
• Provide Governance Risk and Compliance (GRC) support for third-party audit requests and reporting requests from leadership.
• Review, test, and support the system upgrades, framework updates, system enhancements, and related changes to the GRC tool.
• Responsible for ensuring Governance Risk and Compliance (GRC) internal controls are performed (ex. User access review, framework updates).
• Participate in continuous learning initiatives specifically related to the Governance Risk and Compliance (GRC) system, IT governance, controls, insurance, healthcare, understanding frameworks, and information technology.
• Meet with the issue owners and leaders to obtain action plans, enter issue data into the GRC tool, and monitor the GRC tool for overdue issues. Follow the issue escalation procedures for past due GRC issues.
• Understand and review functionality within the GRC tool to assist with Policy and Compliance reporting.
• Assist with GRC workflow procedures within the GRC tool (ex. Review control attestation and move Controls into a monitor state).
• Update approved data changes into the GRC tool (ex. new issues, controls, and policies).
• Monitor email and respond to Control Owners with GRC tool questions such access issues, system workflows, and reporting.
• Run reports from the GRC tool to provide third-party audit requests and related reporting.
• Execute GRC tool system test plans (ex. For system upgrades, updates, enhancements, new reporting).
• Participate in continuous learning initiatives specifically related to the Governance Risk and Compliance (GRC) system, IT governance, controls, insurance, healthcare, leading security frameworks, and information technology.