miovision - GRC Specialist

• Risk & Control Execution • Identify, assess, and track enterprise, cyber, product, and third-party risks, actively expanding our cybersecurity risk universe. • Maintain risk scoring, treatment plans, and evidence in strict alignment with frameworks like ISO 27001, SOC 2, and NIST. • Drive risk remediation and manage risk acceptance workflows, ensuring clear justifications and proper executive approvals. • Governance, Risk & Compliance (GRC) Program Operations • Drive day-to-day GRC operations across ISO 27001, SOC 2, and NIST, intelligently mapping controls to eliminate duplication and boost efficiency. • Collect and validate rock-solid evidence for internal assessments while managing the lifecycle of our security policies and standards. • Proactively research, recommend, and implement high-impact process improvements to streamline compliance efforts. • Audit & Assurance Support • Bridge the gap between theoretical certification requirements and operational reality by building robust audit playbooks and practical controls. • Serve as a key player during critical external audits, coordinating with internal control owners to ensure lightning-fast, highly accurate evidence submission. • Craft accurate, confident responses to customer security questionnaires, RFPs, and due-diligence requests to accelerate sales. • Cross-Functional Enablement • Partner with Engineering, Cloud Ops, IT, and Product to seamlessly embed risk considerations into development, operations, and vendor onboarding. • Act as a key risk gatekeeper for product releases and major delivery milestones, operationalizing highly scalable security controls. • Drive highly engaging security awareness training and clear risk communications across the entire business. • Risk Culture & Cross-Functional Engagement • Champion security best practices and act as an approachable advocate to non-technical, cross-departmental teams. • Spearhead engaging initiatives that build and reinforce a highly resilient, company-wide security culture. • Actively participate in cross-functional risk forums and working groups to keep security top-of-mind across the organization. • Emerging Leadership & Development • Take total ownership of key GRC components (like third-party risk or policy governance) to continuously hone your skills as an independent practitioner. • Drive process automation and program maturity, securely leveraging AI tooling to accelerate and optimize your workflows. • Partner directly with the GRC Manager to support executive reporting and execute high-level strategic initiatives. • The Ideal Profile: • The Compliance Veteran: Experience in GRC, cyber risk, compliance, or information security, ideally within SaaS, cloud, or critical-infrastructure environments. • The Framework Guru: You possess deep, practical working knowledge of at least three major frameworks (ISO 27001, SOC 2, NIST, FedRAMP, FAIR, or COSO). • The Persuasive Diplomat: You know exactly how to explain a control gap to an engineer who passionately disagrees—and successfully get it fixed without causing friction. • The Independent Executor: You are a proactive self-starter who has independently taught yourself new frameworks, tools, or systems just to solve a complex problem you uncovered. • The Auditor's Best Friend: You are highly proficient with modern GRC platforms and have a proven, hands-on ability to build and operate bulletproof risk registers and control frameworks. • The AI Adopter: You are highly effective at using AI to speed up your workflows and ensure accuracy, but you possess the sharp judgment to immediately spot when the machine is wrong. • The Public-Sector Navigator: You bring valuable exposure to the strict, high-stakes requirements of public-sector or highly regulated customers (federal, state, municipal, or transportation agencies).