Responsibilities

•Perform information security risk assessments for new and existing SaaS and cloud-based solutions, client initiatives, and regulatory-driven requests.

•Review and assess third‐party security postures by analyzing SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration test summaries, SIG responses, and security questionnaires.

•Evaluate SaaS architectures, data flows, and hosting models, with particular attention to data protection, encryption, identity and access management, logging, and monitoring.

•Identify control gaps, assess both inherent and residual risk, and partner with stakeholders to define practical mitigation strategies or compensating controls.

•Translate technical and operational risks into clear, business‐focused language that resonates with both technical and non‐technical audiences.

•Collaborate regularly with IT, business, risk, and compliance teams to support timely, well‐informed decision...