Full-Time Information Security Risk and Controls Senior Manager

Information Security Risk and Controls Senior Manager will be part of a team establishing Experian's information security risk and controls framework, informed by industry standards and latest risks.

Responsibilities:

• Lead the second line security risk and controls team, framing and driving the vision for a security risk management framework.
• Collaborate with global partners (1LoD and 2LoD risk practitioners) to develop the enterprise security risk management program.
• Partner with Global Risk Management (GRM), the Business, departments, and other divisional/enterprise risk partners to ensure comprehensive identification, tracking, measurement, mitigation, resolution, and reporting of risks, providing second line oversight of security risk.
• Maintain the information security risk and controls framework following industry standards, enterprise security policies, changing technological landscape, and latest risks.
• Use experience in business processes and technical knowledge to influence the quality of control design supporting ongoing control implementation programs.
• Be the primary security risk liaison for Departments, including executive partners. Communicate with business and technology leaders to ensure visibility and understanding of security risks.
• Maintain knowledge of security best practices, security regulations, trends (cloud and AI), and their impact on Experian's risk environment.
• Demonstrate performing Information Security Risk Management responsibilities and control assessments.
• Background in Information Security Risk managerial/management experience or cyber security consulting experience.
• Expertise in all phases of the risk management lifecycle and execution within a technology or security risk management program.
• Hold CISSP, CISA, CISM, CRISC, or comparable certifications.
• Knowledge of information security risk management frameworks (Open FAIR, NIST 800-37, NIST 800-39).
• Experience with cloud security controls across multiple Cloud Service Providers (CSPs).
• Knowledge of information security control frameworks (ISO 27001, NIST, PCI, HIPAA).
• Experience with GRC tools (Archer preferred).

What is the last date for applying to the job?

Which countries are accepted for this remote job?