Risk And Compliance Analyst

isk and Compliance Manager/Lead

Role Profile : Information Security Controls Manager

Responsibilities:

Management

• Regional central point of expertise for Information technology controls and related governance, risk, and compliance requirements.
• Manage IT policies, processes, and controls to ensure that risks are mitigated, and compliance is maintained with in the risk appetite set by the ITLT.
• Engage and guide other team members and control owners and conduct appropriate testing to validate control effectiveness.
• Provide audit evidence and support to IT control owners including but not limited to the collection of evidence, testing results reporting and risk analysis.

Risk

• Manage a risk-based approach to identify and treat risk as it relates to technology, business strategy and objectives.
• Report on information security control risk profiles.
• Contribute to and maintain IT Group Risk Register.
• Identifies, evaluates, and reports on information security risks, which supports the effective protection of information assets.

Compliance

• Deliver risk mitigation plans in response to changes in control risk profiles driven by internal and external events and through lessons learned.
• Conduct scenario analysis and where relevant, identify further mitigation actions through facilitation of experts, stress-testing, and threat simulations.
• Provide timely KPI and KRI reporting to inform ITLT stakeholders on the measurement and validation of control effectiveness.

Other Responsibilities

• Leverage the governance framework to enable accountability and responsibility in technology.
• Alignment of IT controls to the Information Security Management System framework. (ISMS)
• Deliver value creation and greater efficiency through the elimination of unnecessary complexity within business processes and identification of better ways of working.
• Enforce the alignment of internal and external control documentation in adherence to contractual terms and conditions.
• Conduct quality control activities, including periodically using maturity-assessments where applicable.

Qualifications:

• Degree or College Diploma qualified (desirable)

Knowledge, skills, and experience:

Knowledge of:

• IT governance
• Risk management
• External compliance
• Security management

Experience of:

• Managing personnel on multiple project teams in multiple locations
• Experience in a complex and changing environment.
• External regulatory frameworks including NIST 800-171, ISO27001-2013, COBIT
• Project management experience processes, methodologies, technologies
• Leading audits and assessments of business and technology processes and controls
• Organisational change management
• Continuous learning and development
• Document management

Personal attributes:

• Be detail oriented and technically minded.
• Able to function both as part of a team or as an individual, depending on the project.
• Connect and establish effective, cross-cultural working relationships with all levels of the organisation and externally.
• Strong communications skills, both written and oral, technical, and business facing
• Anticipate the environment, be forward thinking and able to see the ‘big picture’.