Information Security Analyst, GDPR/CCPA Compliance

Information Security, Analyst Risk & ComplianceGDPR/CCPA ComplianceContractReports To: Sr. Program Manager of Risk & ComplianceLocation: Sephora Field Support Center (FSC) – San Francisco or Remote US basedPosition Summary:We are creating an innovative, highly-skilled, results-oriented technology team with a deep commitment to building and implementing a comprehensive Risk Management Framework. As a Risk and Compliance Analyst, you must have a passion for managing corporate security along with a desire to relentlessly champion best practices. Reporting to the Sr. Program Manager – Security Risk and Compliance, you will be responsible for performing functions required to support day-to-day risk management, compliance, and security operations. You will focus on standardization, suitability, and integration of the existing security portfolio incorporating new and more dynamic solutions to make our environment more secure and user-friendly.Position Responsibilities:GDPR Compliance Have a working understanding of GDPR compliance requirements (as it pertains to security components) and an ability quickly learn Sephora internal environment and to own/manage Sephora GDPR Readiness Project while working with cross functional stakeholders.Ongoing implementation of security standards and best practices for the organization, formalizing and socializing processes.Work with Information Technology staff and business units to help assess risk and address security issues.Demonstrate our Sephora values of Passion for Client Service, Innovation, Expertise, Balance, Respect for All, Teamwork, and Initiative.The ability to execute the below are plus but not a requirement: Vendor Security reviews Have experience performing vendor security reviews, learn Sephora Vendor Review Methodology and Perform security review for Sephora USA digital and in-store vendors.Lead security reviews from a technical perspective.Partner with Business and Legal teams to review vendor contracts and add necessary security clauses to contracts.Perform Security Incident Investigations. Learn Sephora Security Incident Response Methodology and provide support to InfoSec Team to investigate and triage security events.Support managing post-mortem action items to remediate security gapsSupport organizational effort to prepare for tabletop exercise across the organization and ensure cross-functional team members' readiness to respond to security events.Desired Qualifications:4-6 years of experience in Security, InfoSec Risk Management, or Security Compliance role.Have a working understanding of GDPR compliance requirements. Previous experience supporting GDPR or CCPA readiness is a must.Previous hand on experience performing vendor security reviews preferable for e-commerce environment is preferred. Experience in identifying key issues working with Business Owner and vendors. Contract review experience is a plus.Must be able to collaborate effectively within InfoSec Team and build effective partnerships across the organization with business stakeholders.A must is an ability to take direction, learn quickly, take the initiative, work independently, be a self-starter.Must have strong communication and problem-solving skills.Must have strong skills to organize and keep track of information/documentation; Attention to detail is an absolute must.Must have some working knowledge of information security principles and best practices in general, specifically relating to at least one of the following: GDPR/CCPA compliance, security incident response, project security review, vendor security review, security awareness, and compliance.Bachelor's degree in Business, Computer systems / or equivalent experience.