Go Enterprise, contact us anytime: email, phone, or chat

Description

Build and maintain the cybersecurity control library composed of global and regional controls aligned against the NIST Cybersecurity Framework and utilizing NIST 800-53 controls as a basis.

 

Establish and maintain the associated test scripts and meta data for the controls as well as the control mapping to laws, regulations, and industry standards. Perform quality review of requests for test script changes to ensure proper rigor is consistently in place across all regions. Assist with conducting the annual inherent risk assessment for each region and globally that is mapped to the controls.

 

Facilitate the annual Control Owner attestation process.

 

Maintain the control self-testing procedures which address testing of control operating design and effectiveness. Identify Control Owners and Testers for each control, provide training, facilitate the self-testing process via a defined schedule, and track status of testing progress.

 

Provide first level quality assurance of the testing documentation, evidence, and other supporting material to confirm the test conclusion is properly supported. Confirm self-test was completed in accordance procedure (e.g. population was complete for each control and proper sample selection).

 

As assigned, provide support to regional CAP teams (e.g. Japan CAP) regarding CAP processes. This isinclusive of second level quality assurance for control tests that has been through the first level QA process in other regional CAP teams.

 

Provide QA results to stakeholders to obtain agreement. Present and discuss any portions of the test and associated documentation that was not executed correctly, accurately, or completely.

 

Collect remediation plans from Control Owners where control gaps have been identified, track progress of remediation, and determine when control is ready for re-test.

 

Assist with facilitation of a robust, annual maturity assessment of the Global Security program against the NIST Cybersecurity framework either via the oversight of an independent assessment conducted by a third party or via self-assessment in alignment with CAP’s procedures. I

 

Provide recommendations for control enhancements and identify testing automation opportunities.

 

Identify integration points into enterprise processes as well as with disciplines that are outside of the security department but have security related responsibilities to provide holistic view (i.e. Asset Management, Patch Management, Application Development, Architecture, Infrastructure, Third Party Risk Management, and Physical Security,).

 

Communicate to leadership the results of assurance testing and changes affecting the organization’s Information Security posture. Apply the organization’s risk tolerance and risk management approach in evaluating the security posture, and escalate matters of significance.

 

Interface with designated stakeholders and subject matter experts that own Cybersecurity controls and educate them on their control related responsibilities.

 

Enhance and maintain the global security capabilities catalog to ensure accuracy and relevancy based on changes in regulatory and framework methodologies.

 

Partner with GRC team to effectively utilize GRC solution for assurance related activities and

reporting.

 

Assist in developing global security strategies and plans to support the Cybersecurity Assurance Program

 

Performs other duties as required.


Responsibilities

  • ducation & Experience
  • Bachelor's Degree in Computer Science, business administration or a related field, and five to six years of information technology security experience, or an equivalent combination of education and experience.
  • Certified Information Security Manager (CISM) or Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP) preferred
  •  
  • Job Knowledge & Skills
  • Excellent verbal and written communication skills. 
  •  
  • Experience applying industry-recognized security standards for Information Security, Physical
  • Security, Business Continuity, Disaster Recovery, Crisis Management, and IT (Asset Management, Configuration Management, Vulnerability Patching)
  •  
  • Knowledge and experience in the following:
  • Technology Risk Management concepts and control
  • Managing to regulatory requirements for protecting information assets
  • Global technology organizational concepts
  • Principles and methods of all information security disciplines
  • Knowledge of regulatory protective requirements of personal private information (i.e. FSA,
  • FISC, HIPAA, GLB, SEC, and financial integrity under Sarbanes-Oxley, etc.)
  • Knowledge of and in-depth experience in the ability to apply industry-recognized security
  • Standards
  •  
  • Core Competencies
  • Action Oriented, Customer Focus, Adaptability, Listening, Ethics and Values, Integrity and Trust
  •  
  • Functional Competencies
  • Business Acumen, Decision Quality, Negotiating, Strategic Agility

Details

  • Travel Up to 25%
  • Incentives Bonus
  • Clearance & Citizenship U.S. Citizenship
  • Remote Work Full remote okay
  • Education Bachelors Degree
  • Salary Range Not provided

Join NinjaJobs!

Registered users get the benefit of full listing views, searches, posting options and more!

Company Ratings powered by

  • 3.7

    Overall Rating - Satisfied


  • Culture and Values 3.9
  • Work/Life Balance 4.0
  • Senior Management 3.5
  • Comp and Benefits 3.3
  • Career Opportunities 3.7