Apply on Employer Site

Control Risks · 3 months ago

Principal, Cyber Assurance

New York, NY

Full-time

Hybrid

Lead/Staff

$200K/yr - $215K/yr

12+ years exp

Control Risks is a leading firm specializing in risk management and compliance. They are seeking a Principal in Cyber Assurance to drive the growth of Digital Risks in the U.S., focusing on cyber assurance, third-party risk management, and regulatory compliance audits while collaborating with various teams to enhance client cybersecurity programs.

ConsultingInsurTechRisk ManagementSecurity

No H1B

Responsibilities

Lead cyber assurance engagements, assessing client cybersecurity programs for compliance with industry standards such as NIST, ISO 27001, and other relevant frameworks

Act as a trusted advisor, ensuring client cybersecurity postures are resilient, compliant, and in line with regulatory requirements

Oversee large-scale third-party risk and compliance audits, ensuring alignment with industry-specific frameworks, regulatory standards, and contractual obligations

Oversee regulatory compliance audits to ensure clients meet required standards and regulations

Advise clients on audit preparation and guide them through maintaining compliance while improving cybersecurity measures

Ensure clients' compliance programs address both current and emerging regulatory requirements

Partner with the penetration testing team to incorporate findings into broader cyber assurance reviews

Lead remediation efforts for high-risk vulnerabilities, aligning them with the client's overall compliance and cybersecurity objectives

Build and sustain relationships with key stakeholders, especially C-suite executives, positioning Digital Risks as a leader in cyber assurance and regulatory compliance

Identify and capitalize on new business opportunities in cyber assurance, third-party risk assessments, and compliance audits

Provide thought leadership on cyber assurance trends, regulatory updates, and best practices to enhance client relationships and grow the practice

Advise clients on continuously improving their cybersecurity and compliance frameworks based on audit findings and risk assessments

Recruit, develop, and lead a high-performing team specializing in cyber assurance, third-party risk management, and regulatory compliance

Foster a culture of continuous learning, ensuring the team stays ahead of emerging trends in cybersecurity and compliance

Contribute to the creation of innovative services and solutions to meet clients' evolving needs in cyber assurance and compliance auditing

Qualification

Cyber AssuranceThird-Party Risk ManagementRegulatory Compliance AuditsPenetration TestingNIST ComplianceISO 27001CISSP CertificationCISM CertificationCISA CertificationAnalytical SkillsCommercial AcumenCommunication SkillsPresentation Skills

Required

Candidates must be legally authorized to work in the US on a permanent basis without sponsorship

Candidates must possess unrestricted US work authorization

12+ years of experience in cybersecurity, specializing in cyber assurance, third-party risk management, and regulatory compliance audits

Proven track record of leading cyber assurance engagements and guiding clients through risk management and compliance processes based on industry frameworks (e.g., NIST, ISO 27001)

Expertise in managing third-party audits and ensuring regulatory compliance across audit lifecycles

In-depth understanding of regulatory frameworks, with hands-on experience delivering compliance audits for both commercial and government sectors

Experience integrating penetration testing and vulnerability assessments into broader cyber assurance strategies

Bachelor's or master's degree in information security, Computer Science, Engineering, or a related field

Relevant certifications such as CISSP, CISM, CISA, ISO 27001 Lead Auditor, SANS, or other recognized credentials in cybersecurity, third-party risk management, and compliance auditing

Strong commercial acumen, with proven ability to generate new business in cyber assurance and regulatory compliance services

Exceptional communication, presentation, and analytical skills with the ability to influence senior stakeholders and deliver impactful insights that improve cybersecurity resilience and regulatory compliance