Information Security Specialist

The position, located in Phoenix, is part of the Global Risk, Banking & Compliance organization and reports to the Director, Independent Risk

• Information Security and Information Technology Oversight. Strong information technology and information security programs are key contributors to loyalty, trust, customer experience, and the Hex. Digital brand. Properly assessing, managing, and overseeing global information technology and information security risk is critical to the Company’s business. The successful candidate will have deep information security and information technology expertise, including industry knowledge and awareness of emerging technologies which impact cyber security . The position requires a demonstrated ability to manage information security and information technology risk , and is a team player who is comfortable working across a range of functions including compliance, legal, operational excellence, privacy, risk oversight, and many other partners to promote best information security throughout the enterprise. The successful candidate will also have demonstrated the ability to assess information security and information technology risk and can provide strong subject matter expertise on current controls and processes. The role will work to improve risk management and control strength by providing independent assessment of, and effective challenge to, key components of the information security and information technology program through process evaluation, reviews and ongoing monitoring.

Responsibilities

1. Conduct independent risk assessment of the information security and information technology programs and provide effective challenge to the design and execution of technical and procedural controls.
2. Provide strong subject matter expertise in the areas of: Active Directory, end-user computing (EUC); inclusive of imaging, software updates and patch management, operating systems for Mac and Windows devices and integration into security tools into the EUC environment. Knowledge of threat and vulnerability management and other technical domains as required.
3. Provide periodic updates, reports, and recommendations regarding best practice information security and information technology controls, risk assessment and risk remediation strategies
4. Actively evaluate and monitor information security and information technology controls.
5. Contribute to the annual risk assessment and benchmark and coordinate risk-based investigations of controls.
6. Conduct industry benchmarking, regulatory requirement gathering and peer-based analysis of available controls, risk assessment methodologies and risk mitigation practices to assess for coverage gaps.
7. Support the development of information security and information technology metrics (e.g. KRIs and KPIs) to continuously monitor and oversee program level risks.

Qualifications

1. Minimum three years of operational experience in one of the following technical domains: Active Directory, end-user computing (EUC); inclusive of imaging, software updates and patch management, operating systems for Mac and Windows devices and integration into security tools into the EUC environment. Knowledge of end-user computer threat and vulnerability management and other technical domains as required.
2. Demonstrated knowledge and experience in security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management etc. .
3. Risk assessment experience is preferred, particularly in a financial services or highly regulated environment
4. Strong verbal and written communication skills and excellent relationship building skills
5. Bachelor's degree in Computer Science, Information Systems, Business Administration or other related field (or equivalent work experience). Advanced degree preferred.
6. Technical certification is preferred (e.g. GIAC, SCCM, MCSA, ACiT, ACMT, CISSP etc.)
7. Working knowledge of framework standards for IS & IT (OWASP, NIST, MITRE, etc.) preferred
8. Strong attention to detail Employment eligibility to work with Hex. Digital in the U.S. is required as the company will not pursue visa sponsorship for these positions. Hex. Digital is an equal opportunity employer and makes employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability status, or any other status protected by law. US Candidates/Employees: Click here to view the "EEO is the Law" poster and supplement and the Pay Transparency Policy Statement . If the links do not work, please copy and paste the following URLs in a new browser window: http://www.dol.gov/ofccp/regs/compliance/posters/ofccpost.htm and http://www.dol.gov/ofccp/pdf/EO13665_Prescribed. Nondiscrimination. Posting. Language_JRFQA508c.pdf ReqID: 18013262 Schedule (Full-Time/Part-Time): Full-time