IT/INFORMATION RISK ASSESSOR - Masco Corporation
Bellevue, PA
About the Job
Reference #: ITINF011347
Description
The IT/Information Security Assessor ("Assessor") is responsible for the assessment, verification, review, and audit of technology controls and/or business process controls across the enterprise. The Assessor will be responsible for risk assessments which will require review and evaluation of IT and/or business systems and processes for compliance with defined regulatory standards, internal processes, and procedures. Additionally, the Assessor will be responsible for the identification of 3rd party and 4th party vendor risks, evaluation of control deficiencies, and recommendation on remediation efforts consistent with IT organizational policies, standards, procedures, and regulatory requirements.
Essential Functions
* Execute vulnerability assessments and compliance reviews; facilitate remediation planning, exposure tracking and communicating risk all done in accordance with industry best practices and established regulatory standards (GLBA, SOX, etc.) and report on mitigation status.
* Provide security architecture knowledge and design concepts by partnering with the Enterprise Risk function to help manage technology related risk.
* Provide technical expertise to support the Vendor Management Team with 3rd and 4th party supply-chain security and risk assessments, audits, tests, and verification activities, and when appropriate make recommendations to mitigate risk.
* Apply or recommend adaptive security requirements and/or measurements based on investigative findings and threat monitoring including performing security risk assessments prior to going into production on new projects.
* Assess systems of various scope and complexity to obtain, review, and interpret evidence provided to validate controls are performed effectively.
* Conduct and lead assessment interviews and tests to identify technology control gaps that introduce risk to the organization
* Execute and assist management with IT audits and regulatory compliance requirements.
* Buildout the development of risk assessments, risk meditation, and performance reporting, through working within the IT function and other partners within the business
* Participate as the liaison between Enterprise Risk and Information Technology/Information Security to improve the overall ability to identify operational risk , with a focus on continuous control mointoring and pivot to emerging technology and cyber security threats.
* Build playbooks for key IT processes and associated process flows
* Build, update, and maintain a global policy governance framework to ensure proper evaluation of controls including the identification of significant control deficiencies.
Additional Essential Functions
* Ensure compliance with Northwest's policies and procedures, and Federal/State regulations
* Navigate Microsoft Office Software, computer applications, and software specific to the department in order to maximize technology tools and gain efficiency
* Work as part of a team
* Work with on-site equipment
Additional Responsibilities
Safety and Health for those without supervisory duties
* Abide by the rules of the safety and loss prevention program
* Perform work tasks in a safe manner
* Report any and all injuries to supervisor
* Know what to do in case of an emergency
QUALIFICATIONS
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Education
Technical Degree Information/Cyber Security or Risk Management Or
Associate's Degree Information/Cyber Security or Risk Management Or
Bachelor's Degree Information/Cyber Security or Risk Management
Work Experience
5 - 6 years Assessing Information Security / Cyber Risk
General Employee Knowledge, Skills and Abilities
* Ability to establish effective working relationships among team members and participate in solving problems and making decisions
* Ability to present and express ideas and information clearly and concisely in a manner appropriate to the audience, whether oral or written
* Ability to actively listen to what others are saying to achieve understanding, sharing information with others and facilitating the open exchange of ideas and information
* Ability to establish courses of action for self to accomplish specific goals, develop and use tracking systems for monitoring own work progress, and effectively use resources such as time and information
* Ability to make right decisions based on perceptive and analytical processes, practicing good judgment in gray areas
Additional Knowledge, Skills and Abilities
Assesses systems security requirements by studying business requirements; conducting system security and vulnerability analyses and risk assessments; studying architecture/platform
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures
Knowledge of security and audit topics such as FFIEC Guidelines, GLBA, PCI and HIPAA a plus
Knowledge of best practices for technology architecture and design
Ability to assess cybersecurity controls and technology configurations
Ability to build update and maintain a global policy governance framework
Experience and ability to build, manage and update SOX controls
Licenses and Certifications
General Cert App Certification in IT Audit, Information Security, or Risk Management by industry recognized organization. Within 1 year
Cert Sec Compliance Professional Certified Information System Auditor ISACA or something similar - Certification in information systems governance, control, risk, security, audit/assurance and business and cybersecurity professionals, and enterprises risk management Upon Hire
The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information. 41 CFR 60-1.35(c)
Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
Description
The IT/Information Security Assessor ("Assessor") is responsible for the assessment, verification, review, and audit of technology controls and/or business process controls across the enterprise. The Assessor will be responsible for risk assessments which will require review and evaluation of IT and/or business systems and processes for compliance with defined regulatory standards, internal processes, and procedures. Additionally, the Assessor will be responsible for the identification of 3rd party and 4th party vendor risks, evaluation of control deficiencies, and recommendation on remediation efforts consistent with IT organizational policies, standards, procedures, and regulatory requirements.
Essential Functions
* Execute vulnerability assessments and compliance reviews; facilitate remediation planning, exposure tracking and communicating risk all done in accordance with industry best practices and established regulatory standards (GLBA, SOX, etc.) and report on mitigation status.
* Provide security architecture knowledge and design concepts by partnering with the Enterprise Risk function to help manage technology related risk.
* Provide technical expertise to support the Vendor Management Team with 3rd and 4th party supply-chain security and risk assessments, audits, tests, and verification activities, and when appropriate make recommendations to mitigate risk.
* Apply or recommend adaptive security requirements and/or measurements based on investigative findings and threat monitoring including performing security risk assessments prior to going into production on new projects.
* Assess systems of various scope and complexity to obtain, review, and interpret evidence provided to validate controls are performed effectively.
* Conduct and lead assessment interviews and tests to identify technology control gaps that introduce risk to the organization
* Execute and assist management with IT audits and regulatory compliance requirements.
* Buildout the development of risk assessments, risk meditation, and performance reporting, through working within the IT function and other partners within the business
* Participate as the liaison between Enterprise Risk and Information Technology/Information Security to improve the overall ability to identify operational risk , with a focus on continuous control mointoring and pivot to emerging technology and cyber security threats.
* Build playbooks for key IT processes and associated process flows
* Build, update, and maintain a global policy governance framework to ensure proper evaluation of controls including the identification of significant control deficiencies.
Additional Essential Functions
* Ensure compliance with Northwest's policies and procedures, and Federal/State regulations
* Navigate Microsoft Office Software, computer applications, and software specific to the department in order to maximize technology tools and gain efficiency
* Work as part of a team
* Work with on-site equipment
Additional Responsibilities
Safety and Health for those without supervisory duties
* Abide by the rules of the safety and loss prevention program
* Perform work tasks in a safe manner
* Report any and all injuries to supervisor
* Know what to do in case of an emergency
QUALIFICATIONS
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Education
Technical Degree Information/Cyber Security or Risk Management Or
Associate's Degree Information/Cyber Security or Risk Management Or
Bachelor's Degree Information/Cyber Security or Risk Management
Work Experience
5 - 6 years Assessing Information Security / Cyber Risk
General Employee Knowledge, Skills and Abilities
* Ability to establish effective working relationships among team members and participate in solving problems and making decisions
* Ability to present and express ideas and information clearly and concisely in a manner appropriate to the audience, whether oral or written
* Ability to actively listen to what others are saying to achieve understanding, sharing information with others and facilitating the open exchange of ideas and information
* Ability to establish courses of action for self to accomplish specific goals, develop and use tracking systems for monitoring own work progress, and effectively use resources such as time and information
* Ability to make right decisions based on perceptive and analytical processes, practicing good judgment in gray areas
Additional Knowledge, Skills and Abilities
Assesses systems security requirements by studying business requirements; conducting system security and vulnerability analyses and risk assessments; studying architecture/platform
Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures
Knowledge of security and audit topics such as FFIEC Guidelines, GLBA, PCI and HIPAA a plus
Knowledge of best practices for technology architecture and design
Ability to assess cybersecurity controls and technology configurations
Ability to build update and maintain a global policy governance framework
Experience and ability to build, manage and update SOX controls
Licenses and Certifications
General Cert App Certification in IT Audit, Information Security, or Risk Management by industry recognized organization. Within 1 year
Cert Sec Compliance Professional Certified Information System Auditor ISACA or something similar - Certification in information systems governance, control, risk, security, audit/assurance and business and cybersecurity professionals, and enterprises risk management Upon Hire
The contractor will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information. 41 CFR 60-1.35(c)
Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
Source : Masco Corporation