About this role
Completion of information security and third-party risk assessments
- Completion of information security risk assessments for projects, initiatives, business applications, services and technologies within agreed SLAs
- Scheduling and completion of periodic risk assessments of business solutions, technologies and third parties based on their risk classification
- Identification, definition and rating of risks
- Explanation of risks and their impact on stakeholders
- Provision of information security risk management support and advice to risk owners, risk action owners and other stakeholders in determining risk management options and action plans
- Completion of third-party information security risk reviews
- Review of supplier information security contractual clauses
- Stakeholder management and liaison
- 3+ years’ experience of technical information security and third-party risk
Assessments
- Knowledge of industry recognized information security and data privacy standards such as Cyber Essentials, ISO 27001, NIST Cybersecurity Framework, CIS Top 20 Controls, GDPR
- Good working knowledge of Service Now IRM and GRC tools
- Good working knowledge of information security controls
- Ability to communicate effectively with a broad range of stakeholders, both internal and external, at all levels
- Strong analytical and problem-solving skills, with excellent attention to detail
- Definition and explanation of information security and third-party risks
- Ability to reflect business drivers and risk appetite in risk assessments
Security certifications such as CISSP, CISM, CRISC are desirable