Information Security Analyst II

Senior Analyst, DSO Policy Assurance Team

As a member of the DSO Policy Assurance Team, the Senior Analyst will be instrumental in enabling adherence to corporate security policies via procedural and automated controls. This individual will become a subject matter expert on cybersecurity policies and governing them and will support business and technology organizations in enabling that adherence. They will identify, track and manage remediation and mitigation activities related to cybersecurity policy adherence. This position will consult on organizational strategy, define, and manage cybersecurity policy scope, propose security tools, and process changes that could impact cybersecurity policies, ensure security and technology teams have prepared appropriate evidence for the required policy assessments, and monitor the progress of any associated activities.

Main Responsibilities:

• Responsible for leading strategic key initiatives that take a proactive approach to cybersecurity policy adherence.
• Responsible for managing or supporting the budget for assigned projects and initiatives.
• Responsible for aligning policies and cybersecurity controls required to support new technologies, designs, remediation, planning and other related efforts
• Responsible for identifying policies and their non-compliance and work collaboratively with partner team for resolution; manage escalations and resulting timelines to ensure compliance
• Responsible for development, testing and communication of controls related to cybersecurity policies
• Responsible for leading and/or participating in reviews, assessments, and/or certifications
• Consult with management on organizational strategy and goals
• Overall management, progress tracking, and reporting of the related respective tasks
• Responsible for managing assigned vendor relationships and resolution of stakeholder issues
• Consult and advise business and partners on control implementation and solutions; support the development of new processes where control gaps exist
• Working closely with cross-functional teams and develop strong liaison relationships

Qualifications:

• 4-7 years Information technology, IT Audit, GRC (Governance, Risk, Compliance) or related field
• 2-5 years IT security control development, control testing, risk remediation, and reporting
• 1-3 years IT security or IT security infrastructure experience
• Experience with eGRC systems, compliance scope management or risk management processes
• Experience with managing internal and external regulatory related audits and assessments
• Knowledge of the IT technology stack and ability to interface the network, technology, application, business, and legal representatives
• Experience with project management (planning, organizing, and managing resources to bring about the successful completion of specific project goals and objectives)
• Ability to identify problems, analyze data and present conclusions effectively
• Strong verbal, written and presentations skills
• Ability to read, identify and interpret policies, regulations, and contract security requirements
• Desired: Certification in one of the following: CIPP, CIPM, CIPT, CISA, CISSP.