Senior Information Security Specialist

Join Halcyon, a remote-first company, as a Senior Information Security Specialist. In this role, you will strengthen our cybersecurity and GRC programs, manage third-party risk, support compliance initiatives, and mature internal security processes. Your responsibilities will include operational security, risk assessment, policy development, and incident response preparedness. Enjoy comprehensive health benefits, competitive compensation packages, and unlimited PTO.

• Coordination across teams to manage third-party risk, support compliance initiatives, and mature internal security processes.
• Performing and maintaining third-party risk assessments, tracking vendor remediation activities, and developing corrective action plans for identified security gaps.
• Collaborating with managed security service providers and internal stakeholders to monitor and manage security events and escalations.

• 5+ years of experience in information security, GRC, or IT risk management
• Hands-on participation in incident response or disaster recovery exercises is a plus
• Demonstrated experience with third-party risk management processes and tooling
• Strong understanding of cybersecurity concepts, controls, and risk frameworks
• Excellent communication, documentation, and cross-functional collaboration skills
• Ability to assess and implement technical and administrative controls across cloud and hybrid environments
• Proven ability to coordinate security testing and vulnerability management efforts
• Experience with regulatory compliance and audit support in fast-paced environments
• Experience with compliance platforms (e.g., Drata, Vanta)
• Knowledge of security frameworks beyond SOC 2 and ISO 27001, such as NIST 800-53 or CIS Controls
• Background in auditing or supporting third-party security assessments
• Experience with Microsoft 365 and/or Google Workspace security configuration
• Familiarity with secure software development practices or DevSecOps principles
• Certifications such as CISSP, CISA, CISM, Security+, or similar are a plus
• Exposure to regulatory environments such as HIPAA, GDPR, or CCPA