Principal Consultant (CYBER-SEC)

Skill Summary

• Technical skills (Required - Mandatory) GRC:

• Documents and maintains the System risk governance methodology, the System risk management policies and the Information Security Policy and Standards.

• Improve and promote the System risk-related and Information security related activities.

• Organizes, conducts and performs system risk and information security risk assessment and gap analysis process.

• Organizes and performs the System risk assessment and gap analysis for all technologies, products, functions introduced.

• Establishes, reviews and verifies the System risk and information security risk related policies, standards and procedures documentation.

• Documents and confirms compliance with the information security requirement for System Development Life Cycle.

• Monitors compliance with the Security Standards, Policy and Architecture.

• Cooperates with the performance of annual mandatory information security awareness seminars to alert employees to the information security and best practices.

• Prepares and/or coordinates Monthly/Quarterly Operational Risk Meeting.

• Performs all other duties as assigned by the Management.

• IT Risk Management

• Maturity Assessment based on industry standard RMF ( Risk Management framework)

• Implementation and Development of at least two Risk Management Framework Project

• Knowledge about Risk Management Framework ( NIST CSF, ISO27001 etc)

• Familiarity with HIPPA, SOX, GLBA, GDPR, PCI DSS etc.

• General Risk Management Responsibilities: Has good knowledge of applicable risk management practices required to create a culture of risk management compliance for his or her group or department.

• Identifies, assesses, and monitors applicable risks based on risk management policies and procedures. Reviews work of subordinates for risk management purposes, if applicable.

• Exhibits best practice risk management skills through effective internal risk controls, risk monitoring, risk assessment and improvement of risk management processes.

• Participates in the development of a global risk framework (a single view of the company’s risk profiles and tolerance.)

• Reviews risk assessments, analyzes the effectiveness of information security control activities, and reports on them with actionable recommendations.

• Monitors risk mitigation and coordinates policy and controls to ensure that other managers are taking effective remediation steps.

• Assists/performs in security assessments and performs security attestations.

• Participates in security investigations and compliance reviews as requested.

• Conducts and reports on internal investigations of possible security violations.

• Consults with clients on security violations.

• Coordinates all IT internal and external assessment components.

• Technical skills (Required - Nice to have)

• 10+ years' experience in the IT risk management and/or IT Audit related activities of the financial industry.

• CISA/CISSP/CRISC accreditation preferred.

• Bachelor’s Degree, Information Systems, Computer Science, Information Security or related field required.

• 6+ years’ experience conducting IT compliance assessments (Sarbanes-Oxley, PCI, etc.)

• 6+ years’ experience in administering IT security controls in an organization.

• Knowledge of technical infrastructure, networks, databases and systems in relation to IT Security and IT Risk.

• Project management skills preferred.

• Windows workstation and server administration experience preferred.

• Prior experience performing security reviews and risk assessments preferred.

• Good oral and written skills on a business level in English.

• Good managerial skills relating to employees, planning and policy formulation.

• Substantive and diverse knowledge of securities-related legal, tax, regulatory compliance

• Job type: Contract Reference: 21-05073