Security Engineer; Compliance

BRG is an Equal Employment Opportunity/Affirmative Action Employer. All qualified candidates will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, disability, or protected veteran status.

Position Title: Security Engineer (Compliance)

Location: Remote - USA

Position Type: Full time

Requisition : JR100641

Second Sight Solutions, a subsidiary of Berkeley Research Group (BRG), is a health technology company, and our innovative technology reimagines how drug discount data is exchanged, establishing new connections and improving transparency for drug manufacturers and their customers. Our customers and partners trust us to deliver reliable, first-to-market solutions and safeguard the data we receive. We trust our employees, and our culture gives them the freedom to create, collaborate, and grow.

Our leaders are industry experts, creative, unafraid to challenge the status quo, and the pioneers of market-changing solutions.

We are seeking a motivated Security Engineer (Compliance) to be an integral part of our Security team! The ideal candidate will be passionate about cyber security and possess both deep and wide expertise in the security space, with specific experience in the application and implementation of Governance, Risk, and Compliance (GRC) programs.

• Own, manage, and support the application of key compliance frameworks (SOC 1 and 2, ISO 27001, CSA STAR, NIST CSF, etc).
• Develop, control, and maintain applicable organizational policies, procedures, best practices, and guides associated with key compliance requirements and in support of annual audits.
• Assist in the development and implementation of an internal audit program designed to:
  • measure the effectiveness of organizational processes and procedures;
  • assess organizational adherence to those processes and procedures;
  • identify opportunities for organizational and systemic process improvement; and
  • alert the organization about emerging risks to the comprehensive compliance program.
• Support the Risk Management Program with a goal of making risk-based decisions an integrated part of the cultural landscape, including:
  • risk identification;
  • risk mitigation;
  • risk monitoring;
  • risk reporting; and
  • documentation of risk realization and/or retirement.
• Work closely with the Security Operations (Sec Ops) team to ensure security functions meet operational compliance requirements and will meet/exceed independent annual audit standards.
• Ensure technical, operational, and administrative controls are fully operable and meet standards necessary for SOC 1 and 2 audits.
• Support Quarterly Access Reviews (QARs) as part of the larger User Access Request process.

• 5+ years of proven work experience as a System or Information Security Engineer, Compliance Engineer, or Risk Engineer.
• Detailed technical knowledge of compliance frameworks and their application across systems and organizations.
• Thorough understanding of the latest security principles, techniques, and protocols.
• Problem solving skills and ability to work under pressure.
• Experience with compliance frameworks (e.g., SOC 1 and 2, ISO 27001, CSA STAR, NIST CSF).
• Familiarity with web related technologies (Web applications, Web Services, Service Oriented Architectures) and network/web related protocols.
• Experience with cloud services (Microsoft 365, SharePoint Online, Microsoft Azure, and Amazon Web Services).
• Operational understanding of security systems, including firewalls, intrusion detection systems, anti-virus software, authentication systems, log management, and content.
• Ideal candidates will have a strong risk background that includes:
  • risk identification, adjudication, and mitigation development experience;
  • experience working with engineering teams to document, plan, and address identified risk items;
  • documentation and communication of identified risks to organizational leadership (up to and include the Executive Leadership Team or ELT);
  • regular review and maintenance of residual risk items; and
  • ownership of risks and the applicable risk lifecycle through risk identification, adjudication,…