Senior Associate – Cybersecurity Risk and Controls Analyst

Career Category

Information Systems

Job Description

Join Amgen’s Mission of Serving Patients

At Amgen, if you feel like you’re part of something bigger, it’s because you are. Our shared mission—to serve patients living with serious illnesses—drives all that we do.

Since 1980, we’ve helped pioneer the world of biotech in our fight against the world’s toughest diseases. With our focus on four therapeutic areas –Oncology, Inflammation, General Medicine, and Rare Disease– we reach millions of patients each year. As a member of the Amgen team, you’ll help make a lasting impact on the lives of patients as we research, manufacture, and deliver innovative medicines to help people live longer, fuller happier lives.

Our award-winning culture is collaborative, innovative, and science based. If you have a passion for challenges and the opportunities that lay within them, you’ll thrive as part of the Amgen team. Join us and transform the lives of patients while transforming your career.

Senior Associate – Cybersecurity Risk and Controls Analyst

What you will do

Let’s do this. Let’s change the world. In this vital role you will support assigned capabilities within the Governance, Risk and Compliance (GRC) team, with a focus on risk management activities like engaging and leading discussions with internal and external customers, evaluating, documenting and communicating information security risks, recommending and testing IT controls and advising on improvements of IT controls.

You will bring forth out of the box thinking, an agile approach, proven domain expertise and an innate understanding of IT risks and controls to empower IT process and product owners to build and maintain secure and compliant IT solutions.

You will perform the following activities and any additional tasks required to evaluate and continuously improves Amgen's information security posture, to effectively reduce risks and satisfy the security objectives of the organization.

• Advise project teams and application owners on information security risks and controls

• Participate in projects or initiatives where a security risks and controls specialist is needed, with a focus on addressing risks by ensuring appropriate security controls are implemented

• Evaluate compliance with security requirements

• Evaluate IT controls’ design and implementation in various IT security processes

• Test operating effectiveness of IT controls, including user access management, change management and computer operations for complex IT systems

• Assess the risks of control deficiencies and identify mitigating controls

• Clearly document and optimally communicate risks and risk mitigation actions

• Understand and leverage ISO and NIST information security frameworks to establish accountability and responsibility for controls within the information systems organization

• Ensure quality of work and timeliness across different functional deliverables; take ownership of issues and coordinate through to completion

• Providing input and ideas based on industry best practices and actual experience to help evolve the security risk and controls areas

• Keeping up-to-date with emerging technological trends, security assessment and risk management methodologies and standards

• Coordinate the outsourced 24x7 security event handling service

• Build and improve processes, critical metrics and service output

• Works on the decrease of false positives

• Review and optimize the configuration of security tools, integrations with other technologies, documentation and delivery of the service

• Assist incident responders as they develop and coordinate response, containment and remediation capabilities

• Support cyber threat intelligence, security operations and other security teams in day by day activities

What we expect of you

We are all different, yet we all use our unique contributions to serve patients. The professional we seek is an experienced cybersecurity analyst with these qualifications.

Basic Qualifications:

Master's

Or

Bachelor’s degree and 2 years of directly related experience

Or

Associate degree and 6 years of directly related experience

Or

High school diploma / GED & 8 years of directly related experience

Preferred Qualifications:

• Sophisticated industry recognized security certification (i.e. CISA, CISM, CISSP, CRISC, Security+, etc.)

• Solid understanding of Information Security principles: confidentiality, integrity, and availability

• Knowledge of international standards fo