Lead and maintain security-related audits (PCI-DSS, SOX ITGC, application controls).
Ensure timely and complete responses to evidence requests and compile management responses and remediation plans as needed.
Conduct regular security audits and assessments to identify vulnerabilities, compliance gaps, and areas of improvement. Implement remediation plans and track progress to address identified issues.
Prepare status report and metrics to business, IT and security leadership on a regular basis.
Develop and deliver cybersecurity awareness programs and training sessions for employees.
Participate in the vendor risk assessment process and provide security risk assessment services and contract reviews to ensure that third parties meet the company’s information security control requirements.
Develop and maintain IT security policy, standards and procedures based on company’s risk appetite, industry best practice guidelines, and regulatory requirements.
Lead incident response efforts, including investigation, containment, recovery, and reporting, and tracking of security incidents.
Advise and train IT process owners on best practices related to information security, cyber risks, IT General Controls, application controls, and remediation of any issues.
Serve as a subject matter export and trust advisor to business units and IT.

A minimum of 5 years of experience in one or more information security roles, including IT security engineer, compliance and cyber risk management, IT Audit, security control process assurance or audit of technology controls.
Demonstrated deep background in risk treatment, controls selection, and information security controls process design.
Demonstrated experience working directly with internal and external auditors to satisfy audit requests, present evidence and provide management responses to findings that are identified during the audit or assessment.
Experience in cloud security controls in different cloud platforms (AWS, Microsoft Azure, GCP, Oracle Cloud).
Experience in web application and mobile application security.
Bachelor’s degree in information security, Management of Information Systems, Computer Science, Cyber Security or related field required. Master’s degree in a related field is an advantage.
Professional security risk management is required such as CISSP, CISM, CISA, CRISC or other similar credentials.

Senior Information Security Compliance Analyst

Key skills