Senior Information Security Lead
for each section. Use - for lists. Use
for prose.
We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate like EEO, privacy policy, etc.
We need to include sections: About the role (company description and role overview), Responsibilities (principal duties), Requirements (education and experience), Qualifications (maybe same as requirements? but we can combine? The instruction: use headings for section headings e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only when posting has real specific content. The posting includes Education and Experience, plus Additional Skills Required. Could map Education and Experience to Requirements, Additional Skills to Skills, maybe Qualifications could be certifications? There's a line: Security certifications (preferred): CISSP, CISM, CCSP, or equivalent. That could go under Qualifications. Also "Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations." Could be Qualifications.
We need to avoid filler like "commensurate with experience". Not present.
We need to preserve all substantive info: company description, role responsibilities bullet list, requirements bullet list, skills bullet list, certifications bullet list.
We must not repeat job title as heading. The title is Senior Information Security Lead; we should not put that as heading.
We need to output only HTML fragment.
Let's structure:
About the role
Genesis Capital (the “Company”) is one of the largest business purpose lenders in the country, focused on providing commercial real estate financing solutions to real estate developers who buy, renovate, and sell single-family and/or multi-family residential real estate. The Company is a subsidiary of Rithm Capital (parent company), a publicly traded mortgage real estate investment trust. The Senior Information Security Lead is a hands‑on senior individual contributor responsible for designing, operating, and governing Genesis Capital’s network and information security controls across a hybrid environment (Microsoft 365, Azure, AWS, and on‑prem). This role serves as the primary security control owner and internal audit gatekeeper for security‑relevant IT General Controls (ITGCs), including responsibility for SOX audit readiness, evidence quality, deficiency remediation, and risk exception governance. The position combines deep technical execution with independent judgment, strategic thinking, documentation rigor, and executive‑level communication, without managing a team.
Then Responsibilities: list essential functions.
We need to capture the bullet points under "Principal Duties: ESSENTIAL FUNCTIONS include the following." We'll create - for each major category and subpoints? The instruction: Use
- for any list of duties/requirements/benefits. So we can list each duty as a li. Could break down sub-bullets as separate li or combine with semicolons. Probably better to keep each major bullet as li, preserving details.
Let's extract:
Network Security (Hands‑On Ownership)
- Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
- Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
- Define and enforce network security standards (Zero Trust principles, segmentation, logging, egress controls) and validate adherence through configuration reviews and monitoring.
- Perform regular firewall, SSE, and network control reviews to identify risk, over‑permissive access, and audit exposure.
Vulnerability & Configuration Risk Management
- Own the vulnerability management lifecycle using Qualys, including scan coverage, severity thresholds, remediation SLAs, and verification.
- Assign and track remediation actions across IT teams; independently validate closure through rescans and evidence review.
- Govern patching and hardening outcomes across infrastructure and cloud services, ensuring results meet security and audit requirements.
- Enforce security‑related change control expectations, including documentation quality and emergency change review.
Information Security Controls & Governance
- Enforce information security policies across Microsoft 365, Azure, AWS, and on‑premise systems, translating policy into enforceable technical controls.
- Conduct security risk assessments for new systems, architecture changes, and third‑party integrations; document risks and required controls.
- Operate and continuously improve security monitoring and alerting (including SIEM tooling where applicable).
- Research emerging threats and technologies and recommend security improvements aligned to business risk.
SOX & Internal Audit Gatekeeper
- Act as the single point of contact for internal and external auditors for SOX and security‑related audits.
- Serve as named control owner for assigned security and infrastructure ITGCs, with responsibility for:
- Control design and documentation (narratives, procedures, evidence standards)
- Evidence completeness, accuracy, and timeliness
- Walkthroughs and auditor inquiries
- Deficiency analysis, remediation planning, and validation of closure
- Maintain audit‑ready documentation and evidence repositories throughout the year.
Risk Exception & Decision Authority
- Act as the security approval authority for exceptions, compensating controls, and risk acceptances.
- Document business justification, compensating controls, and expiration dates for accepted risks.
- Escalate material or systemic risks to executive leadership with clear impact analysis and recommendations.
Incident Response, DR & Resilience
- Lead technical incident response activities, including containment, root‑cause analysis, and corrective action tracking.
- Maintain incident response and disaster recovery documentation; coordinate testing, tabletop exercises, and lessons learned.
Access Governance & Security Awareness
- Conduct periodic phishing simulation testing and analyze results to drive targeted remediation.
- Conduct quarterly User Access Reviews for SOX‑scoped applications and ensure timely remediation of findings.
- Review identity, access, and protection reports to identify control weaknesses and audit exposure.
Reporting & Executive Communication
- Prepare clear, executive‑level reporting on:
- Risk posture
- Vulnerability trends and mitigations
- Audit status and findings
- Control effectiveness and exceptions
We could keep sub-bullets as separate li or nest? HTML doesn't allow nested
inside - ? Actually you can. But to keep simple, we can flatten each bullet as li, preserving details.
Now Requirements: Education and Experience bullet list.
- Bachelor’s degree in Computer Science or related field, or equivalent experience.
- 7+ years of progressive experience in network security and information security within a regulated or sensitive environment (financial services strongly preferred).
- Hands‑on experience securing Microsoft 365, Azure, AWS, and hybrid/on‑prem environments.
- Strong expertise with firewalls, zero trust, and vulnerability management.
- Strong knowledge of Windows/Linux, VMWare, SQL Server, Active Directory, and networking.
- Demonstrated experience acting as primary audit contact and control owner for SOX or similar regulatory audits.
- Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations.
- Experience with Juniper and Cisco/Meraki network switches, a plus.
- Excellent written and verbal communication skills, including audit‑ready documentation and executive briefing.
- Ability to manage IT projects and support strategic initiatives.
- Hands-on experience with SIEM systems and open-source security tools.
- Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
But we might separate certifications into Qualifications.
Qualifications: Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
Skills: Additional Skills Required bullet list.
- Independent ownership and accountability
- Strong risk‑based judgment and business acumen
- Ability to say “no” and document defensible decisions
- Detail‑oriented with audit‑quality rigor
- Comfortable operating as a senior individual contributor authority without formal management responsibilities
We could also include "Ability to manage IT projects and support strategic initiatives" but that's already in Requirements.
Now we need to ensure we don't include Benefits, Pay, Schedule sections because not present.
We must not include boilerplate like EEO, privacy policy.
Now produce HTML.
Check for any repeated content: we included "Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations." in Requirements; also we might not repeat elsewhere.
Make sure we preserve all substantive info: we included company description, role overview, duties, requirements, qualifications (certifications), skills.
We omitted "While this description is intended to be an accurate reflection..." etc. That's boilerplate; we can drop.
Also "By applying to this position candidate acknowledges that this is not a remote role and is required to be on-site." That's substantive? It's a requirement about on-site. Should we include? It's a condition. Could be included in Requirements or maybe a note. The instruction: preserve ALL substantive information; do not invent or summarize away detail. So we should include that statement. Where to put? Could be in Requirements as a bullet: "This is not a remote role; on-site presence required." Or we could add a separate paragraph after Requirements. Probably best to add a
after Requirements: "This is not a remote role; on-site presence required."
Also "Management reserves the right to modify, add or remove duties and request other duties, as necessary." That's boilerplate? Might be considered generic; but it's substantive about job flexibility. Might keep? It's not boilerplate like EEO; it's a statement about duties. Could include in Responsibilities as a note. But the instruction says remove duplicated lines, cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. This line is not exactly those; it's about duties modification. I'd keep it maybe as a
under Responsibilities.
Also "While this description is intended to be an accurate reflection of the position’s requirements, it in no way implies/states that these are the only job responsibilities." That's also a disclaimer; could be considered boilerplate but it's about description accuracy. Might be safe to keep? The instruction says remove EEO/equal-opportunity/scam-warning boilerplate. This is not exactly those. But it's a generic disclaimer. I'd consider it boilerplate and drop. Safer to drop.
Thus include on-site note.
Now produce final HTML.
Let's craft:
About the role
Genesis Capital (the “Company”) is one of the largest business purpose lenders in the country, focused on providing commercial real estate financing solutions to real estate developers who buy, renovate, and sell single-family and/or multi-family residential real estate. The Company is a subsidiary of Rithm Capital (parent company), a publicly traded mortgage real estate investment trust. The Senior Information Security Lead is a hands‑on senior individual contributor responsible for designing, operating, and governing Genesis Capital’s network and information security controls across a hybrid environment (Microsoft 365, Azure, AWS, and on‑prem). This role serves as the primary security control owner and internal audit gatekeeper for security‑relevant IT General Controls (ITGCs), including responsibility for SOX audit readiness, evidence quality, deficiency remediation, and risk exception governance. The position combines deep technical execution with independent judgment, strategic thinking, documentation rigor, and executive‑level communication, without managing a team.
Responsibilities
- Network Security (Hands‑On Ownership)
- Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
- Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
- Define and enforce network security standards (Zero Trust principles, segmentation, logging,
for prose. We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate like EEO, privacy policy, etc. We need to include sections: About the role (company description and role overview), Responsibilities (principal duties), Requirements (education and experience), Qualifications (maybe same as requirements? but we can combine? The instruction: use headings for section headings e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only when posting has real specific content. The posting includes Education and Experience, plus Additional Skills Required. Could map Education and Experience to Requirements, Additional Skills to Skills, maybe Qualifications could be certifications? There's a line: Security certifications (preferred): CISSP, CISM, CCSP, or equivalent. That could go under Qualifications. Also "Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations." Could be Qualifications. We need to avoid filler like "commensurate with experience". Not present. We need to preserve all substantive info: company description, role responsibilities bullet list, requirements bullet list, skills bullet list, certifications bullet list. We must not repeat job title as heading. The title is Senior Information Security Lead; we should not put that as heading. We need to output only HTML fragment. Let's structure:
About the role
Genesis Capital (the “Company”) is one of the largest business purpose lenders in the country, focused on providing commercial real estate financing solutions to real estate developers who buy, renovate, and sell single-family and/or multi-family residential real estate. The Company is a subsidiary of Rithm Capital (parent company), a publicly traded mortgage real estate investment trust. The Senior Information Security Lead is a hands‑on senior individual contributor responsible for designing, operating, and governing Genesis Capital’s network and information security controls across a hybrid environment (Microsoft 365, Azure, AWS, and on‑prem). This role serves as the primary security control owner and internal audit gatekeeper for security‑relevant IT General Controls (ITGCs), including responsibility for SOX audit readiness, evidence quality, deficiency remediation, and risk exception governance. The position combines deep technical execution with independent judgment, strategic thinking, documentation rigor, and executive‑level communication, without managing a team.
Then Responsibilities: list essential functions. We need to capture the bullet points under "Principal Duties: ESSENTIAL FUNCTIONS include the following." We'll create- for each major category and subpoints? The instruction: Use
- for any list of duties/requirements/benefits. So we can list each duty as a li. Could break down sub-bullets as separate li or combine with semicolons. Probably better to keep each major bullet as li, preserving details.
Let's extract:
Network Security (Hands‑On Ownership)
- Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
- Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
- Define and enforce network security standards (Zero Trust principles, segmentation, logging, egress controls) and validate adherence through configuration reviews and monitoring.
- Perform regular firewall, SSE, and network control reviews to identify risk, over‑permissive access, and audit exposure.
Vulnerability & Configuration Risk Management
- Own the vulnerability management lifecycle using Qualys, including scan coverage, severity thresholds, remediation SLAs, and verification.
- Assign and track remediation actions across IT teams; independently validate closure through rescans and evidence review.
- Govern patching and hardening outcomes across infrastructure and cloud services, ensuring results meet security and audit requirements.
- Enforce security‑related change control expectations, including documentation quality and emergency change review.
Information Security Controls & Governance
- Enforce information security policies across Microsoft 365, Azure, AWS, and on‑premise systems, translating policy into enforceable technical controls.
- Conduct security risk assessments for new systems, architecture changes, and third‑party integrations; document risks and required controls.
- Operate and continuously improve security monitoring and alerting (including SIEM tooling where applicable).
- Research emerging threats and technologies and recommend security improvements aligned to business risk.
SOX & Internal Audit Gatekeeper
- Act as the single point of contact for internal and external auditors for SOX and security‑related audits.
- Serve as named control owner for assigned security and infrastructure ITGCs, with responsibility for:
- Control design and documentation (narratives, procedures, evidence standards)
- Evidence completeness, accuracy, and timeliness
- Walkthroughs and auditor inquiries
- Deficiency analysis, remediation planning, and validation of closure
- Maintain audit‑ready documentation and evidence repositories throughout the year.
Risk Exception & Decision Authority
- Act as the security approval authority for exceptions, compensating controls, and risk acceptances.
- Document business justification, compensating controls, and expiration dates for accepted risks.
- Escalate material or systemic risks to executive leadership with clear impact analysis and recommendations.
Incident Response, DR & Resilience
- Lead technical incident response activities, including containment, root‑cause analysis, and corrective action tracking.
- Maintain incident response and disaster recovery documentation; coordinate testing, tabletop exercises, and lessons learned.
Access Governance & Security Awareness
- Conduct periodic phishing simulation testing and analyze results to drive targeted remediation.
- Conduct quarterly User Access Reviews for SOX‑scoped applications and ensure timely remediation of findings.
- Review identity, access, and protection reports to identify control weaknesses and audit exposure.
Reporting & Executive Communication
- Prepare clear, executive‑level reporting on:
- Risk posture
- Vulnerability trends and mitigations
- Audit status and findings
- Control effectiveness and exceptions
We could keep sub-bullets as separate li or nest? HTML doesn't allow nested
- inside
- ? Actually you can. But to keep simple, we can flatten each bullet as li, preserving details.
Now Requirements: Education and Experience bullet list.
- Bachelor’s degree in Computer Science or related field, or equivalent experience.
- 7+ years of progressive experience in network security and information security within a regulated or sensitive environment (financial services strongly preferred).
- Hands‑on experience securing Microsoft 365, Azure, AWS, and hybrid/on‑prem environments.
- Strong expertise with firewalls, zero trust, and vulnerability management.
- Strong knowledge of Windows/Linux, VMWare, SQL Server, Active Directory, and networking.
- Demonstrated experience acting as primary audit contact and control owner for SOX or similar regulatory audits.
- Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations.
- Experience with Juniper and Cisco/Meraki network switches, a plus.
- Excellent written and verbal communication skills, including audit‑ready documentation and executive briefing.
- Ability to manage IT projects and support strategic initiatives.
- Hands-on experience with SIEM systems and open-source security tools.
- Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
But we might separate certifications into Qualifications.
Qualifications: Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
Skills: Additional Skills Required bullet list.
- Independent ownership and accountability
- Strong risk‑based judgment and business acumen
- Ability to say “no” and document defensible decisions
- Detail‑oriented with audit‑quality rigor
- Comfortable operating as a senior individual contributor authority without formal management responsibilities
We could also include "Ability to manage IT projects and support strategic initiatives" but that's already in Requirements.
Now we need to ensure we don't include Benefits, Pay, Schedule sections because not present.
We must not include boilerplate like EEO, privacy policy.
Now produce HTML.
Check for any repeated content: we included "Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations." in Requirements; also we might not repeat elsewhere.
Make sure we preserve all substantive info: we included company description, role overview, duties, requirements, qualifications (certifications), skills.
We omitted "While this description is intended to be an accurate reflection..." etc. That's boilerplate; we can drop.
Also "By applying to this position candidate acknowledges that this is not a remote role and is required to be on-site." That's substantive? It's a requirement about on-site. Should we include? It's a condition. Could be included in Requirements or maybe a note. The instruction: preserve ALL substantive information; do not invent or summarize away detail. So we should include that statement. Where to put? Could be in Requirements as a bullet: "This is not a remote role; on-site presence required." Or we could add a separate paragraph after Requirements. Probably best to add a
after Requirements: "This is not a remote role; on-site presence required." Also "Management reserves the right to modify, add or remove duties and request other duties, as necessary." That's boilerplate? Might be considered generic; but it's substantive about job flexibility. Might keep? It's not boilerplate like EEO; it's a statement about duties. Could include in Responsibilities as a note. But the instruction says remove duplicated lines, cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. This line is not exactly those; it's about duties modification. I'd keep it maybe as a
under Responsibilities. Also "While this description is intended to be an accurate reflection of the position’s requirements, it in no way implies/states that these are the only job responsibilities." That's also a disclaimer; could be considered boilerplate but it's about description accuracy. Might be safe to keep? The instruction says remove EEO/equal-opportunity/scam-warning boilerplate. This is not exactly those. But it's a generic disclaimer. I'd consider it boilerplate and drop. Safer to drop. Thus include on-site note. Now produce final HTML. Let's craft:
About the role
Genesis Capital (the “Company”) is one of the largest business purpose lenders in the country, focused on providing commercial real estate financing solutions to real estate developers who buy, renovate, and sell single-family and/or multi-family residential real estate. The Company is a subsidiary of Rithm Capital (parent company), a publicly traded mortgage real estate investment trust. The Senior Information Security Lead is a hands‑on senior individual contributor responsible for designing, operating, and governing Genesis Capital’s network and information security controls across a hybrid environment (Microsoft 365, Azure, AWS, and on‑prem). This role serves as the primary security control owner and internal audit gatekeeper for security‑relevant IT General Controls (ITGCs), including responsibility for SOX audit readiness, evidence quality, deficiency remediation, and risk exception governance. The position combines deep technical execution with independent judgment, strategic thinking, documentation rigor, and executive‑level communication, without managing a team.
Responsibilities
- Network Security (Hands‑On Ownership)
- Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
- Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
- Define and enforce network security standards (Zero Trust principles, segmentation, logging,
- Network Security (Hands‑On Ownership)
- ? Actually you can. But to keep simple, we can flatten each bullet as li, preserving details.
Now Requirements: Education and Experience bullet list.
- Bachelor’s degree in Computer Science or related field, or equivalent experience.
- 7+ years of progressive experience in network security and information security within a regulated or sensitive environment (financial services strongly preferred).
- Hands‑on experience securing Microsoft 365, Azure, AWS, and hybrid/on‑prem environments.
- Strong expertise with firewalls, zero trust, and vulnerability management.
- Strong knowledge of Windows/Linux, VMWare, SQL Server, Active Directory, and networking.
- Demonstrated experience acting as primary audit contact and control owner for SOX or similar regulatory audits.
- Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations.
- Experience with Juniper and Cisco/Meraki network switches, a plus.
- Excellent written and verbal communication skills, including audit‑ready documentation and executive briefing.
- Ability to manage IT projects and support strategic initiatives.
- Hands-on experience with SIEM systems and open-source security tools.
- Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
But we might separate certifications into Qualifications.
Qualifications: Security certifications (preferred): CISSP, CISM, CCSP, or equivalent.
Skills: Additional Skills Required bullet list.
- Independent ownership and accountability
- Strong risk‑based judgment and business acumen
- Ability to say “no” and document defensible decisions
- Detail‑oriented with audit‑quality rigor
- Comfortable operating as a senior individual contributor authority without formal management responsibilities
We could also include "Ability to manage IT projects and support strategic initiatives" but that's already in Requirements.
Now we need to ensure we don't include Benefits, Pay, Schedule sections because not present.
We must not include boilerplate like EEO, privacy policy.
Now produce HTML.
Check for any repeated content: we included "Working knowledge of ISO 27000, SOX, PCI, and GLBA control expectations." in Requirements; also we might not repeat elsewhere.
Make sure we preserve all substantive info: we included company description, role overview, duties, requirements, qualifications (certifications), skills.
We omitted "While this description is intended to be an accurate reflection..." etc. That's boilerplate; we can drop.
Also "By applying to this position candidate acknowledges that this is not a remote role and is required to be on-site." That's substantive? It's a requirement about on-site. Should we include? It's a condition. Could be included in Requirements or maybe a note. The instruction: preserve ALL substantive information; do not invent or summarize away detail. So we should include that statement. Where to put? Could be in Requirements as a bullet: "This is not a remote role; on-site presence required." Or we could add a separate paragraph after Requirements. Probably best to add a
- for any list of duties/requirements/benefits. So we can list each duty as a li. Could break down sub-bullets as separate li or combine with semicolons. Probably better to keep each major bullet as li, preserving details.
Let's extract:
Network Security (Hands‑On Ownership)
- Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
- Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
- Define and enforce network security standards (Zero Trust principles, segmentation, logging, egress controls) and validate adherence through configuration reviews and monitoring.
- Perform regular firewall, SSE, and network control reviews to identify risk, over‑permissive access, and audit exposure.
Vulnerability & Configuration Risk Management
- Own the vulnerability management lifecycle using Qualys, including scan coverage, severity thresholds, remediation SLAs, and verification.
- Assign and track remediation actions across IT teams; independently validate closure through rescans and evidence review.
- Govern patching and hardening outcomes across infrastructure and cloud services, ensuring results meet security and audit requirements.
- Enforce security‑related change control expectations, including documentation quality and emergency change review.
Information Security Controls & Governance
- Enforce information security policies across Microsoft 365, Azure, AWS, and on‑premise systems, translating policy into enforceable technical controls.
- Conduct security risk assessments for new systems, architecture changes, and third‑party integrations; document risks and required controls.
- Operate and continuously improve security monitoring and alerting (including SIEM tooling where applicable).
- Research emerging threats and technologies and recommend security improvements aligned to business risk.
SOX & Internal Audit Gatekeeper
- Act as the single point of contact for internal and external auditors for SOX and security‑related audits.
- Serve as named control owner for assigned security and infrastructure ITGCs, with responsibility for:
- Control design and documentation (narratives, procedures, evidence standards)
- Evidence completeness, accuracy, and timeliness
- Walkthroughs and auditor inquiries
- Deficiency analysis, remediation planning, and validation of closure
- Maintain audit‑ready documentation and evidence repositories throughout the year.
Risk Exception & Decision Authority
- Act as the security approval authority for exceptions, compensating controls, and risk acceptances.
- Document business justification, compensating controls, and expiration dates for accepted risks.
- Escalate material or systemic risks to executive leadership with clear impact analysis and recommendations.
Incident Response, DR & Resilience
- Lead technical incident response activities, including containment, root‑cause analysis, and corrective action tracking.
- Maintain incident response and disaster recovery documentation; coordinate testing, tabletop exercises, and lessons learned.
Access Governance & Security Awareness
- Conduct periodic phishing simulation testing and analyze results to drive targeted remediation.
- Conduct quarterly User Access Reviews for SOX‑scoped applications and ensure timely remediation of findings.
- Review identity, access, and protection reports to identify control weaknesses and audit exposure.
Reporting & Executive Communication
- Prepare clear, executive‑level reporting on:
- Risk posture
- Vulnerability trends and mitigations
- Audit status and findings
- Control effectiveness and exceptions
We could keep sub-bullets as separate li or nest? HTML doesn't allow nested