Manager - Information Security - Data Governance

JOB SUMMARY

 

Develops policies and standards to support new initiatives or required changes and enhancements due to ever-changing technology landscapes and security regulations. Analyzes existing organizational security policies, standards and controls to ensure alignment with the business environment and the company’s risk appetite. Drafts new and maintains existing policies by coordinating reviews with the organization's policy stakeholders, reviewing any changes and making updates as needed to meet evolving security needs, obtaining leadership signoff of changes and manages publication of the security policies to content management tools for organization consumption.

 

CANDIDATE PROFILE

 

Education and Experience

 

Required:

• Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification
• 5+ years of information technology and/or security experience with:
• 2+ years’ experience creating and managing policies and standards in support of security technologies such as encryption, network security, identity and access management or vulnerability management
• Experience with industry security frameworks including NIST Cybersecurity Framework, NIST SP 800-53, PCI-DSS, Cloud Security Alliance, or ISO 27000 series standards and guidelines.

 

Preferred:

• Current information security certification, including Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)
• Technical leadership experience
• Project management skills
• Excellent communication skills and problem-solving ability
• Demonstrated ability to work independently and with others
• Ability to manage the details and compliance with standards and expectations
• Technical infrastructure operations, administration, or engineering background

 

CORE WORK ACTIVITIES

 

Security Policy

• Oversees, evaluates, and supports the documentation, and validation processes necessary to assure that associates, information technology systems and business processes meet the organization’s information assurance, security, and privacy requirements.  Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations.
• Defines strategy and roadmap, provides governance, creates standards and guidelines, and reviews and approves architectural designs. Ensures standards and guidelines incorporate legal and regulatory requirements. 
• Conducts security and privacy technology research and assessments and integration processes; provides and supports a prototype capability and/or evaluates its utility.
• Consults with customers to gather and evaluate functional requirements and provides security and privacy requirements, guidelines, and standards.
• Manages and administers processes and tools that enable the organization to identify, document, and access intellectual capital and information content (e.g., policies, standards, processes and procedures).
• Provides sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocates policy changes and makes a case on behalf of the company via a wide range of written and oral work products.
• Applies knowledge of priorities to define an entity’s direction, determine how to allocate resources, and identify programs or infrastructure that are required to achieve desired goals within domain of interest. Develops policy or advocates for changes in policy that will support new initiatives or required changes/enhancements.
• Conducts training of personnel within pertinent subject domain. Develops, plans, coordinates, delivers, and/or evaluates training courses, methods, and techniques as appropriate.
• Manages and measures information security implications within the organization, specific program, or other area of responsibility, to include strategic, personnel, infrastructure, policy enforcement, emergency planning, risk management, security awareness, and other resources.

 

MANAGEMENT COMPETENCIES 

Leadership

• Communication - Conveys information and ideas to others in a convincing and engaging manner through a variety of methods.
• Leading Through Vision and Values - Keeps the organization's vision and values at the forefront of employee decision making and action.
• Managing Change - Initiates and/or manages the change pro