Director, Information Security & Compliance

The Director of Information Security and Compliance provides strategic and operational leadership for Information Security and IT Risk Compliance efforts. The role manages and coordinates core aspects of security administration, identity and access management, audit response, and vulnerability assessments within the boundaries of acceptable risk. The director will conduct audits/assessments for IT Compliance, IT Security and Data Privacy. New implementations and operational maintenance of existing business-critical applications will be examined. The role extends to any part of the business that has risk associated with information assets. The Director of Enterprise Security and Compliance reports directly to the Chief Information Officer.

Overall Responsibilities:

• Serve as advisor to executive leadership on information security risks, IT compliance issues, and industry trends that will require prioritization, funding, and/or implementation support.
• Oversee all information security related technologies and third-party vendor relationships.
• Partner with Infrastructure, Operations and development teams to drive adoption and implementation of information security policies, procedures, standards, and incident handling processes.
• Serve as liaison with leadership, legal, and internal audit, to analyze new requirements, standards, and capabilities and to determine feasibility and timing of implementation of new programs and capabilities.
• Conduct assessments/audits to confirm operational effectiveness of IT general controls and identify risk.
• Manage development and assignment of access roles for all users across ERP platforms.
• Provide risk metrics to management regarding audit performance and findings.
• Assist control owners with root cause analysis and track risk management action plan progress.
• Guide efforts to create common control framework and uniform compliance reporting standard.

Specific Responsibilities:

• Planning and reviewing annual review of compliance requirements influencing operations and initiatives in information security, privacy, and IT risk management.
• Performing examination of security controls to determine design and operational effectiveness.
• Coordinate, plan, manage and maintain activities related to application security for multiple ERP systems and related applications, including but not limited to user profile assignments, system access permissions and user account maintenance.
• Evaluate information security related technologies and implement the solutions.
• Planning and reviewing annually the risks influencing the effectiveness of information security, privacy, and information security risk management.
• Studying risk assessments conducted by business owners and support functions to incorporate relevant tests in assessment plans.
• Conducting IT controls management testing of controls independent of the audit schedule to save time during audits.
• Communicating with different levels of IT and business leaders on drivers of the information security risk assessment agenda.
• Preparing the communications schedule with all stakeholders — CIO, CFO, Internal Audit, etc.
• Identifying and tracking assessment/audit performance metrics.
• Implementing and supervising the issue tracking and resolution process.
• Reviewing IT audit risk assessments conducted by internal audit team members.
• Planning third-party audits in consultation with IT, Internal Audit, business process owners and vendor management.
• Reviewing third-party attestation and audit reports and providing feedback to business leaders and risk owners.
• Collaborating with the internal audit team, their agents, and external auditors.
• Monitoring Information Security assessment best practices in the industry to determine opportunities for improvement, including tools and processes.
• Assisting business and support functions in evaluating tools and technology that support the enterprise's risk management approach.
• Providing recommendations to business and IT leaders on practices followed in the industry to mitigate risks.

• Bachelor’s Degree in Business, Accounting, Information Technology, or other quantitative discipline.
• 10+ years of broad privacy and data protection, compliance or legal experience
• 5+ years of audit/assessment experience with PCI or SOX
• 3+ years leading a team of auditors or compliance analysts
• Sound understanding of security principles including logical access controls, change control, least privilege, segregation of duties, computer operations, network security, vulnerability management, and secure coding.
• Broad technical understanding of data management platforms (e.g., IBM DB2, Oracle, Microsoft SQL Server, etc.) and associated data security controls.
• Strong technology acumen and the ability to assess data privacy gaps in products/services design.
• Expert understanding of data classification, data protection, and data retention standards and practices.
• Familiarity with common enterprise and web application technologies.
• Experience with management and oversight of ERP security and role-based access management.
• Experience with project management best practices and collaborating with PMO.
• Experience with common information security management frameworks, such as International Organization for Standardization (ISO) 2700x, ITIL, CSC20, COBIT and National Institute of Standards and Technology (NIST) frameworks.
• Expert understanding of data protection regulations and standards (e.g., PCI, Safe Harbor, EU Data Protection Directive, etc.).
• Strong analytical and time management skills
• Ability to maintain a high degree of confidentiality

• Experience with Oracle’s eBusiness Suite and Identity Management products
• Certified Information Security Auditor (CISA)
• PMI Project Management Professional (PMP)
• Payment Card Industry (PCI) Internal Security Assessor (ISA)
• Certified Information Privacy Professional (CIPP) or Certified Information Privacy Manager (CIPM)
• Industry Standard Security certifications including: SANS/GIAC GSNA, ISACA CISM, ISC2 CISSP, and ISC2 CSSLP.