Senior security compliance specialist

We are currently looking to hire a Senior Security Compliance Specialist for LaBella's Operations Department. This position is located at our Rochester, NY office.

The primary responsibilities of this position are the program management, administration, and maintenance of LaBella’s ISO 27001 and Information Security System (ISMS) program.

Specific Duties/Responsibilities include but are not necessarily limited to the following:

• Management of LaBella’s ISMS committee including scheduling, providing agendas, and keeping minutes of meetings, ensuring membership is maintained as current and relevant.
• Management of LaBella’s ISO 27001 and Information Security Management System (ISMS) program, in cooperation with the Security Operations Manager, including but not limited to:
• Security policy, process, and procedure development and maintenance, in cooperation with Security, IT, and other department and division leadership.
• ISO 27001 document control, including versioning, management reviews and approvals, communication to employees, and updating/maintaining ISO 27001 document management sites including internal and external facing document control web-based sites.
• Developing and maintaining risk assessment and risk acceptance workflow, risk treatment/mitigation plans, and updating LaBella’s risk register in coordination with relevant department and division leaders and executive management on required intervals.
• Development of communication and coordination with executive, department, and division management, regional and office managers, internal and external communication managers, relevant third parties (clients, vendors, etc.), and LaBella data owners.
• Coordinate ISO audits with internal and external resources and develop, track, and communicate corrective action plans.
• Collect and maintain ISO 27001/ ISMS evidence and control documentation, managing the GRC (Governance, Risk Management, and Compliance) platform.
• Establish and maintain an ISMS control ownership model, including assignment of control owners, control performers, approvers, review frequency, evidence requirements, and escalation paths for overdue or deficient controls.
• Coordinate ISMS objectives, metrics, key performance indicators, and key risk indicators, and prepare recurring reporting for the ISMS committee, executive leadership, Security, IT, Operations, and other relevant stakeholders.
• Maintain an ISMS compliance calendar covering internal audits, external audits, management reviews, policy reviews, risk assessments, access reviews, supplier reviews, evidence collection deadlines, training requirements, and certification milestones.
• Coordinate with incident response, business continuity, disaster recovery, and crisis management stakeholders to ensure relevant plans, tests, lessons learned, and corrective actions are captured within the ISMS.
• Promote continual improvement of the ISMS by identifying process gaps, control weaknesses, and opportunities to improve efficiency and consistency.
• Coordinate with IT and Operations staff to ensure system performance and compliance with industry standards for physical and digital security items such as surveillance cameras, access control systems, endpoint management systems, 7x24 SOC, and information security management software as they relate to ISO 27001 certification.

Salary Range: $90,000 - $110,000 per year. The specific salary offered may be influenced by a variety of factors including but not limited to the candidate's relevant experience, education, and work location.

Experience: Minimum of seven (7) years of experience in security compliance or audit program management.

Education: Bachelor’s degree in Cybersecurity Management, technology compliance, or a related technology program management or auditing field. Directly related work experience may be substituted for formal education.

Technical Expertise: Strong understanding of IT infrastructure, networking, security, and software development.

Industry Certifications: Preferred certification includes PMP, CISSP, related auditor or ISO document control certification.

Competencies: Proven ability to work in a team environment, to foster teamwork, and to build collaborative relationships. Self-motivated to continuously seek ways to aid and improve processes. Strong communication and organization skills. An uncompromised ability to keep information confidential. Ability to follow and relay complex oral and written instructions, policies, procedures, and technical information clearly and effectively to both technical and non-technical audiences.

Body, mind, and wallet—LaBella’s benefits support a holistic approach to your health and wellness, creating the foundation for physical, mental, and financial well-being. Our benefit offerings cover the must-haves (healthcare and retirement), the just-in-cases (insurances and employee assistance programs), and the cherry-on-tops (fitness reimbursements, year-end incentive pay, and tuition assistance). Visit our website for more details on benefits listed below.

• Flexible Work Schedule
• Health/Dental Insurance
• 401k Plan with Employer Match
• Paid Parental Leave
• Short & Long Term Disability
• Profit Sharing
• Paid Time Off
• Leadership Development Program
• Fitness Reimbursement
• Tuition Reimbursement
• Referral Bonus Program
• Wellness Program
• Team Building Events
• Community Service Events

LaBella is committed to facilitating a culture where diversity, equity, and inclusion are respected, valued, and celebrated by implementing thoughtful, practical, and innovative strategies that support our employees and serve the communities in which we reside. All applicants will be considered for employment without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender (including pregnancy, childbirth, breastfeeding or other related medical conditions), gender identity, gender expression, sexual orientation, marital status, veteran status, disability, genetic information, citizenship status, characteristic or membership in any other group protected by federal, state or local laws.

LaBella Associates does not accept unsolicited resumes from recruiting professionals or agencies, nor do we accept resumes from any source that does not reference a specific, open position. LaBella Associates will not be responsible for any fees arising from the use of resume submitted by recruiting professionals or agencies that do not have a current placement fee agreement with LaBella Associates. All initial communication with recruiting professionals or agencies must go through human resources.