Governance Risk & Compliance Analyst III

Who We Are

Robert Half, one of FORTUNE’s World’s Most Admired Companies and a Fortune 100 Best Companies to Work For is hiring for a Governance Risk & Compliance Analyst III to join the Information Security Services team.

What You'll Do

• Ensure the continued adoption, maturity, and growth of the following functional areas through adequate planning and sustained execution of required activities:

  • Information Risk Management

  • Audit Lifecycle

  • Policy Lifecycle

  • Compliance

• Responsible for planning, design, enforcement and audit of security policies and procedures which safeguard access to and integrity of RH's global enterprise systems, files, and data elements.

• Maintain knowledge of changing global regulations, guidance and best practices that would result in recommended policy revisions subject to approval.

• Identify and advise RH management of critical issues that may affect customer or corporate security objectives.

• Assist in managing global policies, legal, regulatory, and contractual annual certification and compliance efforts (ISO-27001, SOX, SOC2, HIPAA PCI-DSS, Etc.).

• Act as security risk advisor leveraging industry experience and skills to meet global regulation timelines aligned to business demands.

• Facilitate both internal and external audit teams to identify and report on the effectiveness of implemented information protection controls to determine the overall security posture of RH. 

• Maintain security requirements documentation.

• Contribute and advocate for the ongoing GRC Risk Management program for RH, which will include facilitating risk decisions from stakeholders, tracking risk remediation efforts, developing risk management metrics, and responding to security RFI questionnaires.

• undefined

• Evaluate business-related controls for integrating business and information system security and risk mitigation efforts. Develop and implement tools to support automated risk management and compliance efforts.

• Works closely with our domestic and international business stakeholders, business and IT management, internal audit, and legal counsel to understand business requirements related to security, and regulatory compliance, and to map those requirements to current security and project requirements with intermediate to complex level needs.

• Ensure the continued adoption, maturity, and growth of the following functional areas by adequate planning and sustained execution of required activities:

  • Information Risk Management

  • Compliance

  • Policy Lifecycle Management

  • Security Awareness

• Ensure that new projects and existing application and system implementations comply with applicable compliance frameworks and RH’s information security requirements.

• Act as the liaison between the Enterprise Information Security supporting ATI, ESS, ITSS, Protiviti CIO, CTO, and the Business for any security IT risk and ensure timely resolution of intermediate to complex issues and initiatives

• Provide guidance to functional teams with the implementation, monitoring, and reporting of security control processes, documentation, and compliance measures.

• Advance relationships with developers and engineers; leverage influencing skills to help accelerate the continuous integration of security tools and best practices into our software development lifecycle (SDLC) across all business verticals.

• Experience with GRC Tools, automation and integration with other applications that are sources of evidence

• Promote and manage the communication of best practices for enhanced collaboration among Enterprise Information Security and our large, varied internal development communities

• Identify opportunities for security posture improvement and closely partner with the larger EIS organization and provide advice on a broad range of security strategies

• Contribute and maintain the efficiency, effectiveness and innovation of the program as well as tracking results.

• Actively represent and show presence in the organization as a thought leader and program driver for