Details:
Must Have Skills:
· Lead complex risk assessments, audits, security evaluations, and control reviews across assigned programs, technologies, or business areas.
· Evaluate risk scenarios, control gaps, and remediation options; provide recommendations that align with business objectives and regulatory expectations.
· Partner with business, technology, compliance, privacy, quality, audit, and security stakeholders to develop and track risk mitigation plans.
· Hands -on experience on ServiceNow, JIRA
Nice to have skills:
-
Pharma Regulations
-
Computer System Validation
Detailed Job Description:
The Principal II, Security Assessment & Risk Management, independently leads complex security assessments and risk management activities across assigned business areas, technologies, or initiatives. This role serves as a senior subject matter expert for assigned domains, translates security risk into business impact, and supports risk-informed decision-making while balancing security, compliance, operational resilience, and business enablement. Principal II operates with significant independence but typically remains focused on assigned programs, platforms, or business functions rather than enterprise-wide strategy.
Applicable degree and years of service: Bachelor’s degree in information security, cybersecurity, information systems, computer science, risk management, quality, compliance, or a related discipline; typically 7+ years of relevant security, risk, compliance, audit, technology, or regulated industry experience. Advanced degree or relevant certifications may support equivalency.
· Lead complex risk assessments, audits, security evaluations, and control reviews across assigned programs, technologies, or business areas.
· Evaluate risk scenarios, control gaps, and remediation options; provide recommendations that align with business objectives and regulatory expectations.
· Partner with business, technology, compliance, privacy, quality, audit, and security stakeholders to develop and track risk mitigation plans.
· Review and challenge risk assessments, exception requests, remediation plans, and security decisions within assigned scope.
· Monitor compliance with security policies, standards, and procedures; provide guidance on remediation and control improvement activities.
· Support significant incidents, investigations, and remediation efforts by assessing risk and recommending corrective actions
· Prepare and present risk findings, recommendations, and status updates to management in business-relevant terms.
· Mentor team members and promote consistency, quality, and repeatability in assessment work products.
· Improve assessment documentation, methodologies, templates, reporting, and workflows through standardization and continuous improvement.
Top 3 responsibilities you would expect the Subcon to shoulder and execute:
· Lead complex risk assessments, audits, security evaluations, and control reviews across assigned programs, technologies, or business areas.
· Evaluate risk scenarios, control gaps, and remediation options; provide recommendations that align with business objectives and regulatory expectations.
· Partner with business, technology, compliance, privacy, quality, audit, and security stakeholders to develop and track risk mitigation plans.
Interview Process (Is face to face required?) Yes
