Barnes Information Security GRC Analyst at Barnes supporting technology risk management policies and procedures. Analyzes, documents, and tracks risks related to business operations and supports risk management processes.
Responsibilities
Serve as a point of contact for IT and non-IT stakeholders on technology-related risk questions, escalating issues to senior team members and management as appropriate.
Support other professionals in technology risk management, covering areas such as risk assessments, security policy and documentation management, third-party risk management, and ISO 27001 ISMS operations.
Help identify and assess technology-related risks and maintain the Information Security Risk Register.
Assist with periodic risk reporting to executive management, documenting management’s response to identified risks.
Assist with IT Risk Assessments for on-premises and cloud-based infrastructure, platforms, applications, and key technology services, in line with IT Risk Management Methodology.
Help assess the risks associated with major IT changes and technology implementations.
Track and process exceptions and waivers related to internal security standards, unapproved software, web/email content filtering, password policies, etc.
Work with IT Infrastructure to help ensure that security controls are integrated into Business Continuity/Disaster Recovery planning, ensuring the continuity of security controls where applicable.
Assist with the operation of the Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with ISO 27001:2022 and ISO 27701:2019 standards.
Track and maintain security control requirements from various sources, including ISO 27001 annex controls, client requirements, legal/regulatory guidelines, and other relevant frameworks.
Assist in responding to security audits, questionnaires, and assessments from clients and external parties, supporting marketing and procurement teams with security-related content for client RFPs and vendor agreements.
Help analyze business and IT processes from an information security perspective and identify potential improvements.
Qualification
2 years of relevant experience in ITFamiliarity with IT security policiesFamiliarity with operating systems
Required
Bachelor’s degree or equivalent experience.
2 years of relevant experience in IT, Risk Management, or Information Security; internships or academic coursework may be considered.
Entry-level security or IT certifications such as CompTIA Security+, ISC2 Certified in Cybersecurity (CC), or similar preferred; interest in pursuing advanced certifications such as CISSP or CISA.
Familiarity with IT risk and threat assessment methodologies.
Exposure to or familiarity with security governance, compliance, or control frameworks, including ISO 27000 series, SOC 2 Type II.
Familiarity with IT security policies, procedures, and standards.
Technical knowledge in at least one area such as IT infrastructure, systems engineering, networking, or application development.
Familiarity with operating systems, application architectures, and security technologies.
Working knowledge of network and security protocols, including TCP/IP, SMTP, FTP, SSH, TLS, SSL, HTTP, IPSec, and other VPN protocols.
Basic understanding of IT concepts such as networks, systems and databases, as well as foundational cybersecurity principles (e.g. risk management, threat management, vulnerability assessments).
Strong proficiency in Microsoft Office Suite (Excel, PowerPoint, Word, Outlook) with advanced skills in Excel for data analysis, tracking and reporting.
Ability to work in a fast-paced and demanding environment and respond to shifting priorities while meeting deadlines.
