Senior InfoSec GRC Specialist

About Velsera

Medicine moves too slow. At Velsera, we are changing that.

Velsera was formed in 2023 through the shared vision of Seven Bridges and Pierian, with a mission to accelerate the discovery, development, and delivery of life-changing insights.

Velsera provides software and professional services for:

• AI-powered multimodal data harmonization and analytics for drug discovery and development
• IVD development, validation, and regulatory approval
• Clinical NGS interpretation, reporting, and adoption

With our headquarters in Boston, MA, we are growing and expanding our teams located in different countries!

What will you do?

Compliance & Governance

• Develop, implement, and maintain comprehensive information security policies, standards, and procedures aligned with the ISO 27001 framework
• Lead, manage, and mature the organization's Information Security Management System including risk treatment, internal audits, and readiness for external certification audits.
• Serve as the subject matter expert (SME) for Security and Privacy Rules, ensuring compliance for all systems, processes, and applications handling PII and Protected Health Information (PHI).
• Conduct continuous monitoring and evidence collection to demonstrate compliance with relevant frameworks.
• Plan, conduct and manage internal and supplier audits
• Plan GRC activities, prioritise and implement them in timebound manner.
• Perform detailed security risk assessments and gap analyses on new and existing systems, with a focus on cloud infrastructure
• Collaborate with Product, Technology, IT and Security teams to implement security controls into cloud / infra / environments, ensuring compliance. Provide technical guidance to them on implementing controls and best practices, specifically related to cloud security architecture and configurations.
• Review risk mitigations periodically and track remediation efforts to closure.
• Conduct third-party vendor risk assessments, focusing on their adherence to required compliance standards.
• Develop and deliver targeted security awareness and training programs focused on HIPAA and ISO 27001 requirements for all staff, including technical teams.
• Evaluate and recommend new security technologies and processes to enhance the compliance and risk posture.
• Stay current on emerging cloud security threats, regulatory changes, and updates to the ISO 27001 family of standards and HIPAA.