Senior Cyber GRC Specialist
Job Title: Senior Cyber GRC Specialist
Job Location: Remote
Eligibility/Clearance: ship Required. Law firm experience
required
Job Description:
The Senior Cyber Governance, Risk, and Compliance (GRC) Specialist is
responsible for leading the development, enhancement and implementation
of a comprehensive cybersecurity risk management program for the firm.
Reporting to the Director of Cyber GRC, the Senior Cyber GRC Specialist
will engineer a data-driven risk and control program for assessing
cyber, technology and operational risks rigorously and continuously,
registering and tracking issues to completion, and reporting these
issues to the Cybersecurity leadership and other stakeholders. The
Senior Cyber GRC Specialist will provide strategic insights and guidance
to enhance the firm s risk management and compliance activities to
support its global operations and client requirements. This role
requires hands-on, collaborative work with IT and Cybersecurity
leadership teams and technical subject matter experts.
Responsibilities (include but are not limited to):
- Defines, documents, and manages the firm s Risk Management program,
including processes for identifying, categorizing, assessing, and
registering risks; assigning owners; determining dispositions; and
tracking issues to completion.
- Lead comprehensive risk assessments across all business units,
identifying potential threats and vulnerabilities. Develop and implement
risk mitigation strategies to safeguard the firm s assets and
reputation.
- Provide expert advice to senior management on risk-related issues,
ensuring that risk considerations are integrated into the firm s
strategic planning and decision-making processes.
- Ensure the firm s risk and control program comprehensively accounts
for emerging technologies and risk (e.g., AI).
- Manage security compliance efforts across the firm, ensuring adherence
to industry standards (e.g., ISO 27001:2022) and client requirements
(e.g., CMMC, NIST 800-171).
- Manage the firm s cyber governance forum, reporting on program
progress to the CISO and other senior stakeholders.
- Build and curate Key Performance Indicators (KPIs) and Key Risk
Indicators (KRIs) to highlight control adoption gaps, identify areas of
strong or weak performance, or quantify risks, respectively.
- Identity opportunities to automate control monitoring and work with
technical subject matter experts to define and implement requirements.
- Contribute to the development and implementation of the Business
Resilience plans; conduct Business Impact Analysis (BIA).
- Assess and provide guidance to improve the Business Continuity and
Disaster Recovery plans and procedures across business units to ensure
completeness.
- Uphold high standards of confidentiality, discretion, and integrity,
particularly with respect to all sensitive and/or confidential firm and
client information to which this position will have access.
Requirements:
- Requires 10+ years of experience in risk management, preferably within
a law firm or professional services environment. Proven track record of
successfully managing complex risk projects and initiatives.
- Strong analytical and problem-solving skills, with the ability to
synthesize complex information and develop actionable insights.
- Ability to think strategically and align risk management practices
with organizational goals.
- Superior time-management skills, relentless follow-through, and
metronome-like, consistent delivery.
- Effective written and oral communications skills.
- CMMC and NIST 800-171 experience a plus.
Education:
- Bachelor's degree in Computer Science or Engineering preferred;
advanced degree, CISSP, CISM, CRISC, CISA or other comparable
certifications preferred.
Arena Technical Resources, LLC, (ATR) is an Equal Opportunity Employer
(EOE) who will provide equal employment opportunity to employees and
applicants for employment without regard to race, ethnicity, religion,
color, sex, pregnancy, national origin, age, veteran status, ancestry,
sexual orientation, gender identity or expression, marital status,
family structure, genetic information, or mental or physical disability
Job Title: Senior Cyber GRC Specialist
Job Location: Remote
Eligibility/Clearance: ship Required. Law firm experience
required
Job Description:
The Senior Cyber Governance, Risk, and Compliance (GRC) Specialist is
responsible for leading the development, enhancement and implementation
of a comprehensive cybersecurity risk management program for the firm.
Reporting to the Director of Cyber GRC, the Senior Cyber GRC Specialist
will engineer a data-driven risk and control program for assessing
cyber, technology and operational risks rigorously and continuously,
registering and tracking issues to completion, and reporting these
issues to the Cybersecurity leadership and other stakeholders. The
Senior Cyber GRC Specialist will provide strategic insights and guidance
to enhance the firm s risk management and compliance activities to
support its global operations and client requirements. This role
requires hands-on, collaborative work with IT and Cybersecurity
leadership teams and technical subject matter experts.
Responsibilities (include but are not limited to):
- Defines, documents, and manages the firm s Risk Management program,
including processes for identifying, categorizing, assessing, and
registering risks; assigning owners; determining dispositions; and
tracking issues to completion.
- Lead comprehensive risk assessments across all business units,
identifying potential threats and vulnerabilities. Develop and implement
risk mitigation strategies to safeguard the firm s assets and
reputation.
- Provide expert advice to senior management on risk-related issues,
ensuring that risk considerations are integrated into the firm s
strategic planning and decision-making processes.
- Ensure the firm s risk and control program comprehensively accounts
for emerging technologies and risk (e.g., AI).
- Manage security compliance efforts across the firm, ensuring adherence
to industry standards (e.g., ISO 27001:2022) and client requirements
(e.g., CMMC, NIST 800-171).
- Manage the firm s cyber governance forum, reporting on program
progress to the CISO and other senior stakeholders.
- Build and curate Key Performance Indicators (KPIs) and Key Risk
Indicators (KRIs) to highlight control adoption gaps, identify areas of
strong or weak performance, or quantify risks, respectively.
- Identity opportunities to automate control monitoring and work with
technical subject matter experts to define and implement requirements.
- Contribute to the development and implementation of the Business
Resilience plans; conduct Business Impact Analysis (BIA).
- Assess and provide guidance to improve the Business Continuity and
Disaster Recovery plans and procedures across business units to ensure
completeness.
- Uphold high standards of confidentiality, discretion, and integrity,
particularly with respect to all sensitive and/or confidential firm and
client information to which this position will have access.
Requirements:
- Requires 10+ years of experience in risk management, preferably within
a law firm or professional services environment. Proven track record of
successfully managing complex risk projects and initiatives.
- Strong analytical and problem-solving skills, with the ability to
synthesize complex information and develop actionable insights.
- Ability to think strategically and align risk management practices
with organizational goals.
- Superior time-management skills, relentless follow-through, and
metronome-like, consistent delivery.
- Effective written and oral communications skills.
- CMMC and NIST 800-171 experience a plus.
Education:
- Bachelor's degree in Computer Science or Engineering preferred;
advanced degree, CISSP, CISM, CRISC, CISA or other comparable
certifications preferred.
Arena Technical Resources, LLC, (ATR) is an Equal Opportunity Employer
(EOE) who will provide equal employment opportunity to employees and
applicants for employment without regard to race, ethnicity, religion,
color, sex, pregnancy, national origin, age, veteran status, ancestry,
sexual orientation, gender identity or expression, marital status,
family structure, genetic information, or mental or physical disability