Essential Duties and Responsibilities
- Participating in the solution development process and ensuring that customer requests and needs are represented within the product
- Designing and deployment of enterprise software solutions, including on-site implementations and cloud-based capabilities
- Assisting with performing technical and competitive analysis of ServiceNow GRC, SecOps, Third Party and IT Asset Management solutions, including performance, debugging and other operational metrics.
- Familiarity with risk standards and models is preferred.
- Familiarity with Governance, Risk and Compliance platforms is preferred, especially ServiceNow
- Familiarity with ServiceNow Performance Analytics is a plus
- Familiarity with IT Asset Management solutions is a plus
- Familiarity with risk reporting and dashboard solutions, including Business Intelligence platforms, is a plus
- Ability to communicate difficult subject matter in a clear and concise fashion is important.
- Ability to work with different delivery teams to support technology capabilities as part of larger projects is required.
- Ability to consider non-traditional approaches to solve traditional security challenges is important.
- Experience in offshore team- and capability-development is preferred.
- Communicate (verbally and in writing) externally with clients and internally with all levels of the organization to successfully accomplish objectives portraying knowledge and confidence.
- Motivate others to perform at maximum efficiency without sacrificing quality of the services delivered.
- Maintain a good working relationship with clients and work effectively with client management and staff at all levels to gather information and perform services.
- Work closely with Grant Thornton managers and partners to promptly identify and resolve client problems or issues.
- Other duties as assigned
- Bachelor’s degree in Computer Science, Information Systems, or related field.
- 1+ years of related work experience in a similar consulting practice or function, servicing cross-industry clients at a national level.
- Must have minimally 1 + years of related work experience with GRC platforms
- Must have, or be willing and able to obtain, one or more of the following certifications: CISSP
- Demonstrated working knowledge of various standards and guidelines that are applicable to security practices such as ISO, NIST, COBIT and others.
- Expert-level proficiency in Microsoft Office Suite, specifically Microsoft Word and Microsoft Power Point.
- Must have excellent oral and written communication skills
- Ability to think strategically
- Ability to understand regulatory impacts to client strategies
- Ability to travel on short notice and work additional hours as necessary.
Essential Duties and Responsibilities
- Adhere to the highest degree of professional standards and strict client confidentiality.
- Ability to manage multiple engagements and competing priorities in a rapidly growing, fast-paced, interactive, results-based team environment.
- Ability to communicate in an organized and knowledgeable manner in written and verbal means – including delivering clear requests for information, developing responses to client requests, and communicating conflicts and risks.
- Deep understanding of global privacy and data protection regulations, such as EU’s GDPR and US laws such as CCPA, CPRA, CDPA, CPA, HIPAA, GLBA.
- Apply current knowledge of privacy and data protection trends and to issues and other opportunities for improvement.
- Assist clients in planning and executing remediation plans identified in assessment activities.
- Proactively interact with key client management to gather information, resolve problems and make recommendations for improvements.
- Collaborate with team members at all levels in the development and marketing of the privacy service offering.
- Develop high quality deliverables through collaboration with clients and team members to address needs and demonstrate an understanding of clients’ business.
- Additional duties as assigned.
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science or a related field is required. A Masters or JD degree is preferred.
- 3+ years of related work experience in a similar consulting practice or function, servicing cross- industry clients at a national level.
- Certification(s) Preferred: Obtained or demonstrates an active pursuit of one or more of the following certifications: Certified Information Privacy Professional (CIPP), Certified Information Privacy Technologist (CIPT), Information Systems Security Professional (CISSP), or other related certifications.
- Experience working with leading privacy regulations to perform privacy assessments and support privacy program implementations.
- Experience preparing reports and other deliverables that contain strategy, project, or technical analysis and findings in connection with consulting engagements and communicating those results to the team and client.
- Knowledge of privacy technology solutions and experience implementing and sustaining tools such as OneTrust, WireWheel, Securiti.ai, BigID is a plus.
- Experience in project management and the ability to clearly communicate privacy and data protection issues verbally on both a formal and informal basis to all levels of client staff.
- Exceptional client service and communication skills, with a demonstrated ability to develop and maintain outstanding client relationships.
- Demonstrates creative thinking and problem-solving skills, and advanced knowledge of MS Office Word, Excel, Visio, and PowerPoint.
- Ability to work additional hours as needed and travel on a regular basis to clients as required.
The HITRUST Common Security Framework, “HITRUST CSF”, is a risk based, prescriptive security and privacy framework that streamlines compliance of multiple regulations, risk factors, and standards. The HITRUST Assessor will work closely with clients and other team members, under the direction of an Executive Sponsor, to guide customers through the process of HITRUST Readiness and Validated Assessment to submit to the HITRUST Alliance for Certification.
A good candidate for this position is individuals looking to apply information security and privacy focused frameworks and methodologies to expand their knowledge and skills in diverse and complex data privacy regulations on a global basis. Secondarily this role will provide guidance in implementation of various frameworks for security and privacy.
- Work closely with clients to understand systems and business functions in order to determine the scope of their HITRUST assessments
- Review and evaluate an organization’s information security posture for compliance with the HITRUST CSF and other relevant frameworks
- Develop a GAP assessment with prioritized remediations
- Assist organizations with the implementation of a remediation plan to strengthen information security posture
- Research and understand Security and Privacy matters
- Communicate IT, Security, and Privacy concepts to an organization as it relates to the inscope environment
- Develop and execute test plans to validate an organization’s compliance with the HITRUST CSF for certification submission
Qualifications and Requirements
- BA/BS in information technology, business administration, or related field preferred
- 5+ years in a security/privacy consulting position
- High attention to detail with a focus on persistent and timely follow-up
- Certifications in HIPAA (HCISPP) and or HITRUST (CCSFP, CHQP) is a plus
- Certifications in Security and/or Privacy Technology (CISSP, CIPP) is a plus
- Prior Big 4 consulting experience is a significant plus
- *Post COVID-19 – this position may include travel up to 25%
- Medical, vision, and disability insurance program
- Employer-funded life insurance for all employees
- Unlimited vacation policy with a requirement to take at least two weeks
- Encourage and compensate for advanced training, certifications, and industry events
- Have a voice and be heard with the opportunity to make a positive difference
The Managing Consultant is primarily responsible for managing a team of offensive security consultants and ensuring that the quality of work performed aligns with our standards and client expectations. Secondarily, the Managing Consultant will also execute and deliver client engagements, including penetration tests, threat and vulnerability assessments, purple team engagements, ransomware exposure assessments, and custom assessments designed to meet our clients’ needs. The following high-level goals and objectives are expected to be met by the Managing Consultant.
- Engaged and High Performing Teams
The Managing Consultant plays a critical role in setting the strategy for the offensive security work we perform, staffing the team with the top-tier talent, and creating an environment where consultants can thrive personally and professionally.
Aligning capabilities with client needs and maximizing quality and efficiency is imperative in consulting. The Managing Consultant will continually evaluate how we deliver our consulting engagements, including methodology and technology enablement, to ensure we achieve these objectives. Strategically, the Managing Consultant will be instrumental in helping anticipate client needs and establishing those capabilities on the team.
- Excellence in Project Delivery and Client Relationships
All Security services are designed to forge a trusted partnership with our clients. This comes from ensuring that all security services are delivered with excellence and are executed in a timely manner. Regular communication with clients and the Security Advisory Services team is equally important to ensure that expectations are being met.
- Technical Expertise in Delivered Services
The Managing Consultant is expected to demonstrate technical expertise when delivering our services. Gaps in technical proficiency should be communicated prior to project execution to ensure clients receive expected value. Identified gaps will be used to guide training objectives
- Ownership of Unique or Complex Projects
We offers a wide breadth of service offerings that range from shorter term assessments to more involved, custom security services. The Managing Consultant may be responsible for taking ownership of these projects and client relationships to ensure that unique or complex projects are delivered successfully.
- Prior experience as Lead/Managing Consultant or equivalent corporate experience, such as Manager of Red Team Operations with a record for overseeing offensive security projects such as:
- Threat and Vulnerability Assessments
- Penetration Testing
- Web Application Security Assessments
- Social Engineering
- Proven ability to build and manage high performing teams; and who is adept at communicating clearly, listening, giving feedback, prioritizing, and cultivating skills with individual staff.
- Expert knowledge of offensive security testing, exploitation, and remediation across a range of infrastructure technologies and applications
- Working knowledge of network and systems architecture
- Network segmentation
- Intrusion Detection Systems
- Web application architecture
- Active Directory
- Advanced understanding of how major application layer protocols function (e.g., HTTP, SMTP, DNS, Kerberos)
- Advanced knowledge of categories of malware and how they function (e.g., rootkits, trojans, adware, ransomware)
- Advanced knowledge related to vulnerabilities and attack vectors such as:
- SQL Injection
- Brute force attacks
- Active Directory exploitation
- Malware infection vectors
- Phishing attacks
- Drive-by/Redirection attacks
- Experience performing security assessments on multiple operating systems (Windows, Linux, Unix, OSX)
Experience, Education, and Certifications
- Minimum of 10 years’ experience working in security consulting or equivalent internal roles
- Minimum of two years’ experience successfully mentoring/managing staff
- Bachelor’s degree or equivalent experience
- Offensive security certification(s) expected for this role (e.g., OSCP or similar)