Staff Cyber Security Engineer - GRC (REMOTE)

At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities. 

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive through relentless innovation to exceed our customers’ expectations while making a real impact for our company through our shared purpose. 

When you join our company, we want you to feel valued, supported and proud to work here. That’s why we offer The GEICO Pledge: Great Company, Great Culture, Great Rewards and Great Careers. 

GEICO is a leading insurance provider in the United States, and we are committed to providing exceptional service and delivering innovative financial protection solutions to our customers. As part of our ongoing commitment to maintaining the highest standards of security and risk management, we are seeking experienced and talented Staff Security Engineer to optimize our organizations cybersecurity governance program.  As a Staff Security Engineer in the Cyber Governance department, you will work closely with technical and business teams to assess and drive policy lifecycle management including content creation, creating and aligning standards, ensuring security controls are documented for each standard, managing the security controls lifecycle with evidence, frequency and driving adherence to policies to ensure regulatory compliance is achieved.

Position Description:
The purpose of this position is to provide technical and information security expertise for development and implementation of the information security policies and managing regulatory compliance obligations. You will play a critical role in evaluating and mitigating cybersecurity risks, ensuring adherence to legal requirements, regulations, and industry standards, and development of policies, standards, and guidelines. This role requires a strong background and understanding of all cybersecurity domains. The candidate must use a business risk-based approach to the decision-making process. This position also requires a strong understanding of cybersecurity principles, risk management, and compliance frameworks.

As a Staff Security Engineer, you will:

• Main point of contact for policies, standards, controls and remediation for non-compliance with policies
• Assess and manage information security risks, working actively with stakeholders to mitigate risks
• Collaborate with IT, compliance, legal and risk management teams to ensure regulatory and industry specific security requirements are met
• Conduct security assessments, audits and compliance reviews to identify non-adherence to policies and recommend remediation strategies
• Develop metrics and reporting mechanisms to communicate security risks and compliance status to business and tech partners
• Work with external audits on security certifications e.g. ISO 27001, SOC 2 Type 2
• Prepare controls owners for internal and external audits
• Manage the compliance landscape to keep cyber up to date on expectations and evidence required
• Assist in gathering the audit evidence for all cyber audits including PCI, NY DFS and state exams.
• Review evidence that is gathered by control owners before submitting to auditors
• Work with controls owners to identify opportunities for automating manual processes and controls
• Develop and implement Cybersecurity policy lifecycle, standards and unified security controls.  Drive the annual policy review lifecycle
• Develop dashboards and reporting on adherence to policies
• Working with policy owners, review, update policies and procedures regularly.
• Maintain the governance, risk, and compliance SharePoint site.
• Use knowledge and skills to influence remediation and prioritization of key risks while demonstrating holistic understanding and management of risks according to regulatory requirements and industry best practices.
• Serves as a cyber governance subject matter expert, provides expert advice, and formulate and evaluate contingency plans in partnership with key business stakeholders.
• Stay up to date and informed on developing regulatory concerns and changing IT and information security trends.
• Lead the planning/preparation/execution of audits, providing advisory/expertise, and collaborating with internal teams, SMEs, external customers, auditors, and other stakeholders.
• Educate relevant stakeholders about our solutions and potential opportunities.
• Work closely with various teams to drive feature innovation based upon customer needs.
• Consistently share best practices and improve processes within and across teams

Qualifications

• Experience working independently, providing recommendations, and leading accomplishments from inception to completion
• A