Your responsibilities will include
Program Execution
Support the planning, tracking, and execution of strategic certification and regulatory programs: milestones, owners, due dates, and status across multiple concurrent workstreams.
Coordinate evidence collection, documentation, and readiness activities in support of certification and audit cycles.
Support engagement with external assessors, auditors, and vendors, including scheduling, correspondence, and tracking of deliverables against agreed timelines.
Security Risk Support
Contribute to security risk assessment activities: help identify, assess, and document risks, and support the maintenance of the risk register.
Support risk mitigation and follow-up activities, including tracking corrective actions through to closure and helping confirm that remediation is effective, not just logged as complete.
Help prepare risk and program status materials for internal review.
General GRC Support
Take on additional governance, risk, and compliance activities as priorities evolve, applying sound judgment on how a given task fits existing frameworks and processes.
Maintain organized, audit-ready documentation across the programs and activities supported.
Identify opportunities to improve tracking, reporting, and process efficiency across the programs supported.
2-4 years of experience in information security, GRC, compliance, IT risk, or a closely related field.
Working knowledge of information security and compliance concepts (e.g., risk assessment, control frameworks, certification or audit cycles) sufficient to engage substantively with the work, not only to track it.
Strong organizational skills and comfort managing multiple concurrent workstreams with different cadences and stakeholders.
Clear written and verbal communication; able to synthesize status and findings accurately from multiple sources.
Proficiency with common tracking and documentation tools (e.g., Jira, Excel/spreadsheets); Confluence familiarity a plus.
Discretion with sensitive compliance and security information.
Genuine interest in growing into broader ownership of risk and program work over time.
Prior exposure to security certifications (e.g., ISO 27001, SOC 2), risk frameworks, or regulatory compliance programs is an advantage, not a requirement.
Bachelor's degree in information security, computer science, engineering, or a related field preferred; equivalent practical experience will be considered.
