Description

Own first-line defense risk activities for Information Technology and Information Security.

Responsibilities

• Design and execute IT and security risk program elements to mitigate enterprise risks.
• Implement components of the IT Risk Program, including vendor management, operational risk, and quality controls.
• Lead internal and external compliance technology audits and regulatory exams from planning through remediation.
• Execute Risk Control Self-Assessments (RCSA) for Information Technology and Information Security.
• Develop governance, risk, and control frameworks based on industry standards like COBIT, ISO, NIST, GLBA, SOX, and FFIEC.

Required Skills

• 6+ years of experience in technology audit, Information Security, or Information Technology.
• 2+ years of experience in SOX IT control execution, testing, or IT risk.
• 3+ years of specific experience in Information Security or IT.
• Audit general IT controls including Active Directory, UNIX, Linux, Windows, Oracle DB, and MS SQL DB.
• Audit applications such as Oracle, PeopleSoft, and Salesforce.
• Perform root cause analysis and control gap assessments.
• Design internal control documentation, including narratives and process data flows.
• Knowledge of industry frameworks including COBIT, ISO, NIST, and SANS.
• CISSP, CISM, CISA, or CRISC certification.

Preferred Skills

• Understanding of business risks associated with the financial services industry.

Key Skills

Education

Any Graduate