Sr Associate, Information Security Governance, Policy & Control

About the role

The Senior Associate, Information Security Governance, Policy & Controls joins the Information Security and Risk Management team in the CISO office, reporting to the Associate Director, Information Security Governance, Risk and Compliance. It is a change-agent position focused on developing information security policies, standards and controls, monitoring compliance with regulations and policies, and safeguarding company assets while protecting the confidentiality, integrity and availability of information. The role suits someone with a mix of technical knowledge, knowledge of industry best practices, frameworks and regulations, and a background in information security risk and compliance management.

Key responsibilities

• Develop or enhance information security policies, control objectives, controls and standards aligned with regulations, best practices and frameworks.
• Develop and oversee a control framework to prevent or deal with violations of legal guidelines and internal policies.
• Partner with process and control owners to document processes, risks and controls via process flows.
• Perform control testing and compliance assessments to identify and manage security risks and issues.
• Support front-line controls, self-assurance and risk assessment activities such as ad-hoc control reviews, business process management (BPM), risk control self-assessment (RCSA) and independent risk and audit activities.
• Monitor the risk profile regularly and report risks, issues, events and initiatives, and review assessment results with stakeholders across the lines of defense.
• Assess exposure to risk, measure operational risk against enterprise risk management (ERM) frameworks, and help establish policies and procedures to minimize risk and protect against data loss and reputational damage.
• Work with Issues Management and other control testing functions to update control effectiveness and residual risk ratings.
• Assist internal and external auditors in addressing audit questions and findings, and support testing of control design and effectiveness.
• Identify gaps in processes, methodologies and policies, recommend improvements, and drive adoption of best practices in report templates and tools.

Required profile

• Bachelor's degree in Computer Science, Engineering or a related field, or equivalent work experience.
• English at B2+ level or higher.
• CISA, CRISC, CISM or CISSP certification (one or more) preferred.
• Demonstrated advanced verbal and written communication skills, excellent organization skills, and a self-motivated learning approach.
• Experience with information security risk management frameworks, assessment, audit and controls based on industry standards (NIST, ISO, COSO, HiTrust, CMMC).
• Experience with regulatory requirements such as PCI, GDPR, HIPAA, privacy, CCPA and similar.
• Experience using GRC tools such as RSA Archer, Security Scorecard and Risk Recon.
• Demonstrated experience across multiple information security domains preferred.