Security Operations & Compliance Engineer

Work with cross-organizational stakeholders to determine the understandability and relevance of published security policies and their impact on the business. Develop cyber resilience strategies. Design policies and procedures regarding risk management, access control, cloud security, patch management, and change management. Interact with management and stakeholders to implement security controls. Provide supporting guidelines and tools to enable a culture of security. Complete Gap Analysis of Enterprise Cyber Security and Product Security and Forming an Information Security Steering committee and charter. Present Gap Analysis to Security Steering Committee and Audit Committee and obtaining buy-in for Info Sec Initiatives and tasks. Design information security policies and procedures for the organization such as access control policy, risk management policy, cloud security policy and procedures, BCP/DR, Secure Development Policy, Patch management, Third-party vendor risk assessment and Change Management Policy. Document business initiatives and their security implications and assess Risk Management (Identifying, Assessing and Controlling) risks. Conduct security awareness and training across the enterprise and supporting businesses based on the security and operational risks identified. Conduct BIA, risk assessments and providing reports to the leadership team and stakeholders. Design Security Management Plan for the product teams to enable implementation and controls. Design and train Product teams on security and Privacy by Design. Interact with third party vendors in price and service negotiations for onboarding security MSP and tools. Respond to Cyber insurance renewal questionnaires and Product Customer Security Risk Assessments. Integrate different SAST and DAST tools to JIRA and automation. Submit for FDA 510k. Threat Modelling (STRIDE) for Products and training Software Architects in using Threat Model requirements for FDA submissions. Work with Quality control and Regulators for Safety Risk Assessment of the Product. Work with Department of Defense on Product Security assessments. Work with GCP, Azure, Active Directory, Security Command Center, Cisco Meraki Firewall, Crowdstrike, Intune, Zoho, Nessus, Burp Suite, Kali Linux Microsoft TMT, Snyk SAST, Helm SBOM, JIRA, Service Desk, Outlook, wizer security. 40 hrs/wk. Must have Bachelor’s Degree (3 or 4 year U.S. or foreign degree) in Computer Science, Computer Applications, or a related field, and five (5) years of experience in the proffered position, or as Quality Assurance Specialist, Information Security Lead, Chief Security Officer, or related occupation. Must have 1 year experience developing cyber resilience strategies; Designing policies and procedures regarding risk management, access control, cloud security, patch management, and change management; Interacting with management and stakeholders to implement security controls. Telecommuting permitted. Email resume referencing ID#382 to hr@vtherm.com or mail resume to: HR, Vapotherm, Inc., 100 Domain Drive, Suite 102, Exeter, NH 03833.