Information Security & Risk Manager

The Information Security & Risk Manager (ISRM) is an individual contributor responsible for supporting and advancing Empyrean’s information security governance, risk, compliance, and assurance program. The role provides leadership for the ISO 27001 Information Security Management System (ISMS), security risk assessments, control evaluation, policy governance, audit readiness, and remediation activities. The ISRM partners with business, technology, Security, Privacy, and leadership stakeholders to identify, assess, document, monitor, and communicate information security risks and to promote practices aligned with established policies, standards, and control requirements. ESSENTIAL DUTIES AND RESPONSIBILITIES Lead Empyrean’s ISO 27001 certification, surveillance, internal audit readiness, and ongoing ISMS compliance activities. Coordinate ISO 27001 control testing and communications with control owners, business partners, and audit stakeholders. Support directly or indirectly other assessments and assurance activities, including SOC 2, NIST AI RMF, NIST CSF, NIST 800-53, HIPAA, and other applicable frameworks or requirements. Coordinate and collaborate with Empyrean business units to identify, assess, and communicate risks and control gaps in support of the established control environment and second-line-of-defense (2LoD) oversight. Partner with business and technology management to develop, implement, track, and validate corrective action and risk-remediation plans. Manage and coordinate audit and assessment activities related to ISO 27001, SOC, information security, cybersecurity, business applications, and integrated technology controls. Lead and/or coordinate information security risk assessments associated with major technology initiatives, material environmental changes, third parties, emerging technologies, control exceptions, and other identified risk events. Support and facilitate recurring security risk and governance meetings, including preparation, documentation, and follow-up activities. Maintain the enterprise information security risk register and related risk, issue, exception, and remediation documentation. Provides technical expertise to the teams and uses sound security and compliance practices. Applies analytical skills to review information and determine potential control weaknesses. Uses technical and compliance skills to design secure ways to accommodate exceptions to the established security policy in order to support the business. Participate in meetings with business units and control owners to discuss control requirements, assessment results, risks, and remediation activities. Partner with Security and Privacy teams to understand the information security and privacy risk profile and apply that knowledge to risk, audit, and assurance planning. Lead the development and coordination of information security and technology responses for client security questionnaires, RFPs, due-diligence requests, internal inquiries, and related materials; participate in client meetings as a security and risk subject-matter expert when needed. Partner with security and engineering teams to review, assess, and evaluate the effectiveness of the enterprise cybersecurity threat and vulnerability monitoring and management plan. Identify gaps in security policies, standards, and supporting documentation and develop or revise documentation to address identified needs. Maintain and coordinate updates to information security policies, standards, and related governance documentation. Work cross-functionally on technology initiatives to provide security risk and IT controls expertise, evaluate control design and implementation, and support alignment with established control requirements. Apply knowledge of applicable legal, regulatory,