Associate IS Security Engineer

In this vital role, you will be responsible for identifying, analyzing, and mitigating IT-related risks to the organization. This role will involve working closely with various groups to ensure that risk controls are in place, policies are adhered to, and security standards are met. The IT Risk Analyst will assist in developing and maintaining risk management frameworks, performing assessments, and supporting regulatory compliance efforts.

Roles & Responsibilities:

Risk Identification and Assessment:

• Conduct risk assessments to identify vulnerabilities in IT systems, processes, and policies
• Assist in the identification and evaluation of risks associated with third-party vendors and partners
• Maintain the IT risk register, documenting risks, issues, and remediation actions

Risk Mitigation and Monitoring:

• Recommend risk mitigation strategies and implement risk management controls across IT infrastructure
• Collaborate with IT, cybersecurity, and business teams to track and resolve identified risks and vulnerabilities
• Monitor and report on the effectiveness of existing IT risk controls and recommend enhancements as needed

Compliance and Regulatory Support:

• Ensure compliance with relevant industry standards and regulatory requirements (e.g., GDPR, SOX, PCI-DSS, NIST)
• Assist in audit preparation by internal and external parties, providing documentation and evidence of IT risk management practices
• Support the development and implementation of IT governance, risk, and compliance frameworks

Vendor Risk Management:

• Conduct vendor risk assessments to ensure alignment with internal risk and security policies
• Regularly review vendor performance and risk exposure in collaboration with procurement and legal teams

Basic Qualifications

Education:

• Bachelor's degree in Information Technology, Cybersecurity, Risk Management, or a related field
• Certifications such as CRISC, CISA, or CISSP are highly desirable

Experience:

• 2 4 years of experience in IT risk management, IT auditing, or information security
• Hands-on experience with risk management tools and frameworks (e.g., ISO 27001, NIST, COBIT)

Skills and Competencies:

• Solid understanding of IT infrastructure, systems, and security best practices
• Ability to assess technical and business risks related to information systems
• Excellent problem-solving, analytical, and communication skills
• Ability to communicate complex risk concepts to non-technical stakeholders
• Ability to interpret and assess security clauses in third-party contracts, such as Security Requirements Schedules (SRS)
• Familiarity with regulatory frameworks and compliance standards (GDPR, HIPAA, SOX, PCI-DSS)

Technical Knowledge:

• Proficiency with risk management tools, GRC (Governance, Risk, and Compliance) software, and security incident management tools
• Experience with security controls for networks, databases, and cloud environments

Soft Skills:

• Excellent analytical and problem-solving skills
• Strong verbal and written communication skills
• Ability to work effectively with global, virtual teams
• High initiative and self-motivation
• Ability to manage multiple priorities successfully
• Team-oriented with a focus on achieving team goals
• Strong presentation and public speaking skills
• Effective collaboration with distributed teams