Information Security GRC Specialist

abra professional services is seeking an Information Security GRC Specialist to lead information security governance, risk management, compliance, and audit processes, ensuring alignment with organizational policies, security standards, and regulatory requirements.

This is a full-time position located in central Israel.

Key Responsibilities:

• Develop, update, validate, and implement information security policies and procedures.
• Support compliance with ISO 27001 standards and relevant regulatory requirements.
• Coordinate SOX and ITGC controls related to information systems.
• Prepare for and support internal and external information security audits.
• Conduct periodic security compliance reviews and monitor the implementation of security policies.
• Manage information security risk assessments for vendors and third parties.
• Review and respond to security questionnaires from vendors, customers, and business partners.
• Prepare responses to information security requirements in tenders and business agreements.
• Review security requirements and contractual security clauses in collaboration with relevant stakeholders.
• Coordinate risk assessments, audit findings, remediation plans, and follow-up activities.
• Prepare reports, status updates, and presentations for management and steering committees.
• Collaborate with IT, Legal, Procurement, Risk Management, and external vendors.

Requirements:

• 1–3 years of experience in Information Security GRC, compliance, IT auditing, or information security governance roles – mandatory.
• Practical knowledge of ISO 27001 and security audit and control processes – mandatory.
• Experience writing, updating, and maintaining information security policies and procedures – mandatory.
• Understanding of information security risk assessment processes and security controls – mandatory.
• Excellent written communication skills in Hebrew and English – mandatory.
• Strong organizational skills, task management abilities, and experience tracking compliance gaps and working with multiple stakeholders – mandatory.

Advantages:

• Experience working with SOX and ITGC controls.
• Experience conducting third-party security risk assessments and responding to security questionnaires.
• Familiarity with the NIST Cybersecurity Framework (NIST CSF).
• Knowledge of Israeli Privacy Protection Law and Privacy Protection Regulations (Data Security).
• Experience working in enterprise environments or organizations with multiple systems and vendors.