Conjointly is an all-in-one survey research platform, with easy-to-use advanced tools, real human respondents in your target audience, and expert researchers on hand, covering everything from simple surveys to advanced conjoint, product, and pricing research, as well as conversational and video surveys.
We are looking for a Senior Cybersecurity and GRC Analyst to keep Conjointly secure. You will monitor and protect our systems, find vulnerabilities, and make sure risks are closed rather than just recorded. Around 70 to 80% of the role is hands-on cybersecurity; the rest supports our governance, risk and compliance (GRC) work for SOC 2, ISO/IEC 27001 and ISO/IEC 27701.
Responsibilities:
Cybersecurity
- Planning & Coordination: Plan and coordinate cybersecurity activities across the business, and keep security policies and procedures in line with best practice.
- Security Monitoring: Monitor and triage security alerts across our environments, logging and monitoring tools, and endpoints, and help strengthen our monitoring, including centralised log monitoring.
- Threat Investigation: Investigate suspicious activity such as phishing, unusual logins and malware, and track emerging threats that could affect us.
- Vulnerability Management: Run vulnerability scans, validate and triage findings and bug bounty reports, and work with developers on fixes.
- Access Oversight: Oversee and review user access managed by other teams, including privileged accounts and timely removal of leavers’ access.
- Risk Assessment: Identify and assess cybersecurity risks, and follow up with owners until every issue is closed.
- Security Controls: Recommend, tune and monitor security controls to prevent and detect breaches.
- Incident Response: Investigate, document and coordinate the response to security incidents, and contribute to post-incident reviews.
- Security Awareness: Run security awareness training and phishing simulations for all staff.
- Reporting: Maintain incident logs and risk reports, and present cybersecurity updates at the annual management meeting.
Governance, risk and compliance (GRC)
- Security Questionnaires: Complete supplier and customer security questionnaires and compliance requests.
- Penetration Testing: Arrange penetration tests and liaise with testers.
- Audit Support: Supply technical evidence for SOC 2, ISO/IEC 27001 and ISO/IEC 27701 audits, and help keep security documentation audit-ready.
- Risk Management Meetings: Run the risk management meeting and keep the risk register up to date.
Requirements
- Degree in Computer Science, IT, Cybersecurity or a related field, or equivalent experience.
- At least one cybersecurity certification is required, such as CISSP, CompTIA CySA+, GIAC (GCIH or GSEC) or a cloud security certification.
- 5+ years of hands-on cybersecurity experience, including security operations, vulnerability management and incident response; experience in a larger or regulated organisation is preferred.
- Strong knowledge of cloud, network, endpoint, identity and application security.
- Hands-on experience with AWS security services, log monitoring, endpoint management and protection, and vulnerability scanning tools; SIEM and EDR experience is highly regarded.
- Familiarity with SOC 2, ISO/IEC 27001 and ISO/IEC 27701, including audit evidence and security questionnaires.
- Independent, cautious and thorough, with the persistence to follow up with colleagues at all levels until work is done.
- Able to explain risk clearly to non-technical staff and present to management.
Benefits
- Opportunity to grow into a security leadership role.
- Engaging and dynamic team working towards a common mission.
- Competitive salary.
- Sponsorship of annual maintenance and membership fees for relevant cybersecurity certifications.
New Zealand