Security (GRC) Engineer

The GRC Engineer will contribute to the development and operational execution of the program., * Support the GRC operating model and the service-oriented customer engagement model.

• Provide Information Security Data Governance program expertise and drive the operational delivery of the program.
• Provide AI Governance and development expertise to business units and key stakeholders.
• Utilize current tools to design, build, and enhance team processes using AI agents and intelligent workflows.
• Maintain AI roadmaps and related communications to security leadership.
• Provide Information Security Risk Management support and assist with the operational delivery of the program.
• Perform risk assessments to address security threats, changes to systems and/or applications, process improvement initiatives, supplier assessments (including downstream outsourcers) and other requests from the business.

Accountable for:

• Aligning governance and operational activities to industry best practices and current standards, as defined by internal policies and international standards bodies.
• Develop processes to utilize AI functionality to improve and enhance efficiencies, without sacrificing quality and accuracy.
• Build new AI-driven internal processes to assist with prioritizing and risk-scoring activities.
• The use of defined risk methodologies and best practices to perform Security assessments. Responsible for the planning, scoping, tracking, and execution of these assessments.

• Competent industry certifications, and extra points for AI-related certifications.
• Candidate must have at least 7 years professional experience in governance, risk and compliance and/or information security and risk management.
• Functional knowledge of the CISSP security domains and information security industry standard and best practices.
• Functional knowledge of applicable security regulatory and compliance requirements (EU AI Act, SOX, GDPR). Functional knowledge of ISMS governance models and analysis of certification reports (i.e. ISO 42001 & 27001, SOC, CAIQ), information security roles, security controls.