Information Security Risk & Compliance Analyst

Job Seekers can review the Job Applicant Privacy Policy by clicking here.

Job Description:

Summary
The Information Security Risk & Compliance Analyst will be responsible for assuring information security and managing risks related to the use, processing, transmission and storage of information and the systems and processes used for those purposes. The Analyst's role lies within the Chief Information Security Officer's organizational structure, reporting to the Manager of Information Security Governance, Risk and Compliance. The Analyst will be a key member contributing to the development and maintenance of information security policies, standards, and controls, assessing and prioritizing risk across the organization, compliance with existing and future frameworks, legal and regulatory standards and the development and reporting of information security metrics. The Analyst's role will help prepare for and facilitate assessments and examinations by independent information security assessors. The Analyst will perform third party supplier security assessments, as well as facilitate and coordinate responses for customer due diligence questionnaires.

Essential Functions

• Perform information security risk assessments and risk management activities across new and existing information technology solutions. Establish and maintain risk criteria, identify, analyze, and evaluate information security risks. Ensure that repeated information security risk assessments produce consistent valid and comparable results. Maintain repository of documented information about the information security risk assessment process. Conduct risk and vulnerability assessments of planned and installed information systems. The Information Risk and Compliance Analyst will create, organize and articulate summarized risk findings that are clear and actionable by business stakeholders, reduce risk by helping to prioritize and drive remediation efforts throughout the organization, and contribute to risk management, treatment, and reporting process efforts to protect data assets.
• Perform all ongoing compliance activities related to the implementation, maintenance, monitoring and continuous improvement of Ryder’s existing Information Security Management System (ISMS) based on the requirements of ISO/IEC 27001 International Standard as well as future compliance requirements. The analyst will work with various levels and departments across the organization to ensure appropriate documentation is maintained as evidence of competence and compliance and help to facilitate internal and external independent examinations. The analyst will also help to develop and implement an effective and unified global information technology/security compliance program with applicable data protection standards, legislation, as well as customer information security requirements.
• Perform information security, governance, risk and compliance assessment reports on third party suppliers to ensure supply chain risk is managed throughout the supplier's lifecycle. Produce final reports of pros and cons, observations of anomalies, and deliverables for the business as well as mandates for supplier compliance. Articulate results of the final assessments to business stakeholders, project sponsors, program managers, and other internal parties. Assist with review of information security sections within supplier contracts to ensure security and data privacy requirements are in place.
• Assist with the evaluation of the effectiveness of information security management and performance by developing, monitoring, gathering and analyzing information security and compliance metrics for management. Develop and implement a risk reporting framework for management teams and governance committees.
• Design and document IT general controls to ensure the business demonstrates compliance with its regulatory or compliance obligations. Facilitate and coordinate activities and responses related to internal and external controls testing including entitlement reviews. Facilitate the remediation of control gaps and escalate critical issues to management. Work closely with control owners, internal and external auditors to ensure requests are completed for timely delivery to audit. Assist with third party audits and certifications for the organization (i.e. SOC, ISO, PCI, etc.)
• Assist with responding to customer information security requirements and due diligence questionnaires. Coordinate and facilitate response gathering in conjunction with other organizational application, support, infrastructure, legal, HR, and physical security teams as necessary. Ensure responses are accurate, valid, consistent and reported within expected deadlines. Mai