Note: The job is a remote job and is open to candidates in USA. Ivy Rehab Network is dedicated to providing exceptional care in physical therapy and related services. They are seeking a Security Engineer to manage and automate their Governance, Risk, and Compliance (GRC) program while ensuring alignment with industry standards and conducting vendor risk assessments.
Responsibilities
- Lead the design, rollout, and continuous improvement of the internal GRC framework and security architecture
- Author, maintain, and help enforce information security policies, procedures, and control frameworks across the business
- Identify opportunities to automate compliance tracking, evidence collection, and risk reporting workflows to eliminate manual processes
- Ensure organizational alignment with industry standards (e.g., NIST CSF, HIPAA, HITRUST) and facilitate internal or external security assessments
- Own the end-to-end third-party risk assessment process; evaluate vendor security postures, SOC 2 reports, and risk profiles prior to onboarding
- Partner with legal, procurement, and business stakeholders to communicate vendor risks and negotiate necessary security safeguards
- Manage and monitor the Data Loss Prevention (DLP) solution; triage data exfiltration alerts and partner with business units to implement, enforce, and refine data classification schemas
- Drive the security awareness training strategy; oversee automated phishing campaigns, measure program effectiveness, and deliver tailored education to mitigate human risk
- Provide secondary support to SOC operations by validating alert triage and improving detection logic
- Collaborate to improve SIEM/SOC use cases, detection logic, and incident response workflows
Skills
- Minimum 3-5 years of experience in Cybersecurity, with a focus on GRC or third-party risk management
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field
- Excellent communication, collaboration, and problem-solving skills
- Relevant security certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM)
- Deep understanding of security frameworks and standards such as NIST CSF, HIPAA, HITRUST
- Proven ability to analyze vendor security documentation (SOC 2 Type II, SIG questionnaires, penetration test reports)
- Experience utilizing GRC platforms (e.g., SmartSuite, Archer, ServiceNow GRC, or similar), low-code/no-code platforms, or scripting to automate security processes and compliance mapping
- Excellent communication and collaboration abilities – able to explain complex risk concepts to non-technical stakeholders and work cross-functionally to drive security initiatives
- GIAC certifications
- Certified Information Systems Auditor (CISA)
- Certified in Risk and Information Systems Control (CRISC)
- Former NOC/SOC experience
Benefits
- Eligibility for full benefits package beginning within your first month of employment.
- Generous PTO (Paid Time Off) plans and paid holidays.
Company Overview