Implement the cyber risk strategy and advise on critical areas for opportunities and improvement.
Program alignment to ISO 27005, CIS Top 18 Controls, and the NIST Cybersecurity Framework.
Oversees initial project development surrounding new processes and integrating new processes with existing ones. Communicates these changes to impacted clients and other resources.
Leads process improvement and long-term information security solution discussions and presents outcomes in written and verbal format to senior management.
Oversees initial project development surrounding new processes and the integrating of new processes with existing ones. Communicates these changes to impacted clients and other resources.
Support the GRC tool responsibilities, escalating any strategic or large decision-making to the risk manager.
Assist in tiering the backlog of LS&Co. vendors using the defined vendor tiering criteria and perform internal and 3rd party security risk assessments. Prioritize and select controls based on risk assessment frameworks, and partner with internal stakeholders to document each control.
Determine the effectiveness of in-scope controls by implementing the risk management framework aligned to ISO 27005, including management of the security risk policy, control mapping, and implementation of the risk management process in the GRC tool.
Drive the policy lifecycle management process to manage & govern policies, policy lifecycle, attestation, communication, issue and actions, policy processes, and overall governance; manage the Cyber Risk Policy and make revisions as needed.
Manage the day-to-day exception process within the GRC tool for all GIS teams, while maintaining updates to procedures.
Support risk mitigation or risk acceptance efforts while assisting stakeholders to reach a common understanding of the risks and a defined plan to either mitigate or accept the risk(s).
Assist in the assessment and quantification of GIS identified top risks and critical assets by performing risk analysis to increase awareness and facilitate risk identification activities.
Partner with regional BISOs to understand local compliance requirements and perform a risk analysis to support global compliance and other operational risk activities.
Manage risk remediation plans, including setting deadlines, following up on progress, and reporting on outcomes to ensure issues are mitigated and managed, risks are accounted for, and security exceptions are tracked in accordance with frameworks, policies, and standards.
Document and communicate corrective action plans based on risk assessment findings, ensuring issues are mitigated and managed, risks are accounted for, and security exceptions are tracked in accordance with frameworks, policies, and standards. Partner with stakeholders to develop a continuous control monitoring (CCM) approach by leveraging the GRC tool to build custom workflows and metric dashboards to drive action between risk assessments.
