Principal Information Security Analyst - Risk Management

What You Need To Know

 

Open the door to a groundbreaking tech career with an industry leader. Southern Glazer’s Wine & Spirits is North America’s preeminent wine and spirits distributor, as well as a family-owned, privately held company with a 50+ year legacy of success. To create a new era in alcohol beverage sales and service, we’re heavily invested in the most transformative new technologies – and the most brilliant tech professionals. Southern Glazer’s was named by Newsweek as a Most Loved Workplace and is included on the Forbes lists for Largest Private Companies and Best Employers for Diversity.

 

As a full-time employee, you can choose from a full menu of our Top Shelf Benefits, including comprehensive medical and prescription drug coverage, dental and vision plans, tax-saving Flexible Spending Accounts, disability coverage, life insurance plans, and a 401(k) plan. We also offer tuition reimbursement, a wellness program, parental leave, vacation accrual, paid sick leave, and more.

 

We offer continuous learning and career growth in a fast-paced environment where you are respected, your voice is heard, and technology is part of our strategy for success. If you’re looking to fill your glass with opportunity, come join our FAMILY.

Overview

 

The Principal Information Security Risk Analyst is responsible for planning and monitoring risk remediation/mitigation planning based on internal and external assessments and audits. The person in this position will need to have extensive knowledge of information security risk and third-party risk management, as well as IT systems architectural concepts and business 
processes. This position works closely with all IT areas including Infrastructure, Application Development, Database, Network, Security Operations, and various business functions.

This position reports directly to the Manager of Information Security Governance and Risk Management.

Specialized Skills and Technologies

 

• Knowledge of cybersecurity policies, regulations, and security frameworks
• Familiarity with network technologies and protocols (switches, routers, firewalls, VPNs, remote connection technologies, and multiple domain environments) 
• Understanding and comprehension of a wide range of compliance and technology frameworks
• Ability to analyze and solve problems, think outside of the box, and grasp technical concepts 
• Excellent attention to detail
• Ability to support industry standard third-party questionnaires (SIG, SIG Lite, NIST, CAIQ, etc.)
• Proven ability to maintain an IT risk register, perform risk assessments, and provide risk reporting and metrics
• Articulate ideas in a business and user-friendly language
• Effective communication and decision-making
• Able to work remotely with minimal supervision
• Dedicated team player who can work across multiple functions and disciplines
• Capable of developing and delivering effective presentations to at all levels within the organization

Primary Responsibilities

 

• Risk Management & Remediation
• Act as an Information Security Risk Management subject matter expert
• Assist the Information Security Risk Manager and GRC Director in the development and maintenance of the risk register and remediation plans.
• Conduct regular risk assessments, document issues and exceptions, determine risk levels, and coordinate with the appropriate subject matter experts to monitor the remediation of deficiencies.
• Monitor the established risks in the IT organization and report on the effectiveness of related mitigating controls.
• Work closely with the Information Security Governance and Compliance teams and with Information Security leadership to ensure cybersecurity policies, standards, and practices are well designed, applicable, and adequately support risk mitigation.
• Work closely with the Security Architecture team, participate in architecture reviews and project meetings, to identify the risk and potential impact of new projects and architectural changes to IT and the organization.
• Participate heavily in the implementation of the ServiceNow Risk Management solution and its regular maintenance.
• Assist with periodic reporting and presentation on status for a variety of risk-related stakeholder requirements.

Preferred Qualifications

 

• Master’s degree in related field preferred.
• Cyber security related certifications such as CISSP, CISM, CISA, etc. 
• Vendor certifications from Cloud Service Providers, Networking, Operational Technologies, and related areas.
• Experience in one or more of the following areas: implementing GRC/IRM tools (experience with ServiceNow GRC/IRM a p