Leaf Group

Leaf Group is a house of brands, creating and cultivating digital-first companies in growing lifestyle categories: Fitness &amp; Wellness (Well+Good, Livestrong.com); Home &amp; Decor (Hunker, Society6, Deny Designs), and Art &amp; Design (Saatchi Art, The Other Art Fair). Additionally, we have performance focused brands in key categories such as Travel, Pets, and DIY (OnlyInYourState, Cuteness, eHow). Our media and marketplace brands are authentic and authoritative, reaching a large and growing passionate audience. We work in a fun, collaborative environment that is diverse, adventurous, and open-minded. We look for proactive, accountable people focused on continuous learning and growth to push themselves and our businesses forward. Check us out <a href="https://www.leafgroup.com/brands/" rel="noopener noreferrer nofollow ugc" target="_blank">here</a>.As the Sr. Information Security Engineer, you will help us improve our information security, privacy, compliance, and risk management practices.A big vision calls for a big job.  As we grow, our need for a Sr. Information Security Engineer grows with us.You’ll Report To: SVP, Technical Operations
<h3>A typical day as a Sr. Information Security Engineer might include:</h3>
<ul>
<li>Architecting, installing, managing, and troubleshooting technical security controls such as Firewalls, Intrusion Detection Systems, Security Information Event Monitoring systems, vulnerability scanners, Malware solutions, Anti-Virus, Authentication systems, Virtual Private Networks, File Integrity Monitors, and/or other network security devices.</li><li>Researching, evaluating, testing, recommending, communicating and implementing new security software or devices. Present written findings and recommendations as necessary.</li><li>Maintaining on call duties / scheduling as required for Investigation and Incident Response and as directed by the Director of Information Security.</li><li>Performing continual vulnerability, threat and risk assessments on all application environments using both automated analysis tools and manual procedures. </li><li>Continuously researching new threat vectors, vulnerabilities, exploits, etc., determine how they apply to Leaf Group, design and document proposed risk treatment controls.</li><li>Making  all reasonable efforts to safeguard the network against unauthorized infiltration, modification, destruction, or disclosure.</li><li>Analyzing risk of existing network and system architectures and their security policies, document risks and propose risk treatment plans. </li><li>Evaluate operating practices and component level diagrams to determine if controls and security measures are adequate.</li><li>Participate in enhancing the Information Security Program by developing new and / or proposing updates to technical control standards supporting the various Demand Media platforms and environments.</li><li>Assisting software engineers with implementing best secure code development practices, vulnerability testing in development and testing as well as in production. </li><li>Providing technical security support to the Network Engineering, Systems Engineering, Network Operations Center and Corporate IT teams.</li><li>Independently leading projects, coordinating efforts with all team members, ensuring proper communication to management as well as the overall success of the project through to completion.</li><li>Fostering  and maintaining amicable relationships with security vendors and partnerships.</li></ul>
<h3>What You Have:</h3>
<ul>
<li>Minimum of 3 years of related work experience implementing network infrastructure and at least 6 years focused on operational security</li><li>Expert-level knowledge and experience managing network and security devices such as; firewalls, IDS / IPS, SIEM's, AV, Malware devices, VPN's, vulnerability scanning tools, etc. </li><li>Extensive investigation and incident response experience analyzing networking technology including TCP/IP, Routers, Switching, VLANs, LANs, WANs and Wireless systems, Windows and Linux servers.</li><li>Familiarity with network architectures and technologies, Windows Active Directory, Windows-Linux server, desktop operating systems, database and application architecture, etc.</li><li>Expertise in either Windows or Linux helpful</li><li>Must have IT Security auditing experience throughout work history conducting device configuration and security policy reviews, penetration testing, vulnerability assessments including web application vulnerabilities, network architecture assessments, system security assessments, general security posture and risk assessments, etc. </li><li>Must have experience with SOX and PCI compliance control frameworks </li><li>ISO 27001, COBIT, Safe Harbor, Privacy and Breach and Disclosure law favorable</li><li>Project management skills including requirements analysis, project scoping, problem solving, status reporting, technical analysis, and meeting tight deadlines.</li><li>A desire to participate in creating the workplace you want to be a part of.</li><li>We're casual and informal but we work hard and work responsibly. Personal accountability goes a long way. We believe we are the change.</li></ul>
<h3>Desired Qualifications:</h3>
<ul>
<li>CISSP, CISA, or other industry certifications</li><li>Professional memberships with ISACA, ISSA, IRCA</li></ul>You’ll be successful if you are passionate and committed in making a significant impact to improving our security and compliance maturity. About us:Leaf Group is among the 2022 &amp; 2019 Built In LA Best Places To Work Among Comparably's 2021 Best Companies for Company Culture, Company Perks &amp; Benefits, Company Compensation, Best CEO for Diversity, and Best CEO for WomeneHow is the 2019 &amp; 2020 People's Choice and official Webby Winner for Social Video/How To-DIY OnlyInYourState is ranked the #3 Travel and Information Site (ComScore)Well+Good is the 2019 People's Choice winner of the Webby’s Award for Best Lifestyle BrandLeaf Group is among TalentDesk’s 2019 Best Companies To Work ForWell+Good is the 2018 winner of Fast Company’s Most Innovative Company AwardMyPlate is the 2018 winner of the Webby Award for Best DesignWinner of the 2017 Best Company for Diversity award ComparablyWe are a wholly owned subsidiary of Graham Holdings Company (NYSE: GHC), a storied diversified holding companyFor full-time permanent roles:Competitive compensation and benefits packages (i.e., Medical, Dental, Vision, FSA, 401K)Gender neutral family leavePaid-to-play vacation rewardsDiscretionary unlimited vacation timeEmployee discounts for Saatchi Art, Society6, and Deny DesignsProcess:Step 1: A video/phone call with a member from our Hiring Team. In this call, we will cover the basics of the role and our company, and discuss a high level overview of your past experiences, goals, and interest in this role.Step 2: A call with your potential manager or someone from the hiring team to dive deeper into your experiences and goals.Step 3: If applicable, short assessment to help us see your skill sets as they relate to the role we have. We will review this in Step 1.Step 4: Depending on the role, interviews with key stakeholders from the role (could be 1 or up to 3) who will dive further into the role with you and answer any questions you may have.Leaf Group is a diverse, equitable, and inclusive workplace that reflects our customers and the world we live in. We encourage people from all backgrounds, ages, abilities, and experiences to apply for our roles. Leaf Group is an equal opportunity employer. We do not discriminate based on race, color, ancestry, religion, national origin, sexual orientation, age, citizenship, marital or family status, disability, gender, gender identity or expression, pregnancy or caregiver status, veteran status, or any other legally protected status.Agency Disclosure: If the Leaf Group Talent Acquisition department, or any current company employee, receives an unsolicited resume from a third party recruiting agency and Leaf Group does not have a signed Agency Agreement active, Leaf Group will not be deemed liable to pay a placement fee. The unsolicited resume will be considered a gift and can be considered for our recruitment efforts.

Sr. Information Security Engineer - TechOps

Sotheby&#x27;s

<p><strong>ABOUT SOTHEBY'S</strong></p>
<p>Established in 1744, Sotheby’s is the world’s premier destination for art and luxury. Synonymous with innovation, Sotheby’s promotes access, connoisseurship and preservation of fine art and rare objects through auctions, private sales and retail locations. Our trusted global marketplace is supported by a network of specialists spanning 40 countries and 50 categories, which include Contemporary Art, Modern and Impressionist Art, Old Masters, Chinese Works of Art, Jewelry, Watches, Wine and Spirits, and Interiors, among many others.</p>
<p><strong>THE ROLE</strong></p>
<p>Sotheby’s Information Security team is undergoing an exciting and strategic transformation and we are looking for a dynamic program lead to join the team. The Information Security team is challenging the industry status quo and is not satisfied doing things “the way they’ve always been done.” </p>
<p>This position will work very closely within Information Security as well as Cross Functional teams in ensuring the success of the first ever information security program at Sotheby’s. The Program Lead is accountable for the implementation of OKRs, KRIs to track the implementation of the Information Security policy framework and processes that will protect Sotheby’s data.</p>
<p><strong>RESPONSIBILITIES</strong></p>
<p>You will serve as a central point of contact for Information Security &amp; IT and ensure operations and strategy are working as planned. Your main function will be to work with the primary stakeholders and help develop and implement programs that will mature Sotheby’s Information Security and IT Programs. You'll collaborate with product, engineering, and business operations teams to prioritize and manage security &amp; IT initiatives, coordinate work, create new processes and mature existing workflows.</p>
<p>What You Get To Do Every Day:</p>
<ul>
<li>Provide support with strategic planning and daily initiatives.</li>
<li>Act as a key point of contact with IT management, information security management and business unit stakeholders for cybersecurity and IT related projects.</li>
<li>Assist with program roadmaps and communications disseminated throughout the organization.</li>
<li>Work in tandem with the CISO and other technology leaders on financial planning and analysis, and additional fiduciary responsibilities.</li>
<li>Monitor all information security and IT projects and procurement from inception to successful completion, fully understanding the purpose of projects, technologies and their value-add to the organization.</li>
<li>Work with information security management to help define key performance indicators (KPIs) and metrics that align with business initiatives and deliver to non-technical individuals.</li>
<li>Support security governance process across the business in conjunction with an information security steering committee and advisory board.</li>
<li>Provide effective, hands-on technical program management to drive completion of initiatives across multiple business functions</li>
</ul>
<p><strong>IDEAL EXPERIENCE &amp; COMPETENCIES</strong></p>
<ul>
<li>5+ years of relevant work experience in Information Security, or Information Risk project/program management</li>
<li>Bachelor’s Degree</li>
<li>Experience with SAP, cloud platforms (AWS, Azure, GCP, Salesforce), SaaS, SSO (Okta, OAuth, etc), CASB, DLP, vulnerability management software</li>
<li>Prior experience with technical business applications, knowledge of IT infrastructure and IT risks and controls preferred</li>
<li>Knowledge of IT regulatory and compliance requirements strongly preferred</li>
<li>Desired certifications, one or more of the following: CISSP, CISM, CISA, CIA, CRISC.</li>
</ul>
<p><strong>Preferred Experience:</strong></p>
<ul>
<li>Has knowledge of information security frameworks, best practices, and regulations (GDPR, PCI, CIS, NIST CSF, etc.)</li>
<li>Possesses one or more information Security certifications (CISSP, ISA, ISACA, SANS, etc.)</li>
<li>Has public cloud (AWS/Azure/GCP) information security experience</li>
<li>Leads with a growth mindset and question the information security status-quo &amp; ‘security theater’ that may be found elsewhere</li>
<li>Has one or more relevant professional certifications (CISSP, SANS, CISM, or other) and will continue to grow and achieve professional goals.</li>
<li>Has demonstrated successful experience in a related area, such as security engineering or operations, management consulting, or management and has the ability to discuss and articulate more technical and complex security topics (in addition to risk management concepts and the process of risk assessments).</li>
<li>Has confidence in their expertise, but also knows who to look to for help. Achieving greater skill sets and expanding their understanding of security control techniques should be an on-going goal.</li>
<li>Understands they must gain experience in other areas of technical or operational engineering. Ongoing education to maintain their certs and challenge their expertise will motivate this person.</li>
<li>Understands workload management including understanding and seeking help prioritizing. They help others on the team that may need their leadership, but their leadership qualities enable them to also lead people outside of their team or department.</li>
<li>Is able to communicate reports to coworkers in any department and help them understand proper information security controls, especially to non-technical team mates</li>
<li>They help coworkers figure out good security controls without compromising ethics or introducing unacceptable risk. </li>
</ul><p>To view our <strong>Candidate Privacy Notice</strong> for the US, please <a href="https://www.sothebys.com/en/docs/pdf/candidate-privacy-notice.pdf" rel="noopener noreferrer nofollow ugc" target="_blank"><strong>click here</strong></a><strong>.</strong></p>
<p>To view our <strong>Candidate Privacy Notice </strong>for the UK, Hong Kong, France and Switzerland, please <a href="https://www.sothebys.com/en/docs/pdf/final-v1-sothebys-recruitment-privacy-notice-uk-hk-france-and-switzerland-31-january-2022.pdf?locale=en" rel="noopener noreferrer nofollow ugc" target="_blank"><strong>click here</strong></a><strong>.</strong></p>
<p><strong><em>The Company is an equal opportunity employer and considers all applicants for employment without regard to race (including, without limitation, traits historically associated with race, such as natural hair, hair texture, and protective and treated or untreated hairstyles), color, creed, religion, sex, sexual orientation, marital or civil partnership/union status, national origin, age, disability, pregnancy, genetic predisposition, genetic information, reproductive health decision, sexual orientation, gender identity or expression, alienage or citizenship status, domestic violence victim status, military or veteran status, or any other characteristic protected by federal, state/province or local law. The Company complies with applicable state and local laws prohibiting discrimination in employment in every jurisdiction in which it operates.</em></strong></p>

New York

Information Security Program Lead

<p><strong>ABOUT SOTHEBY'S</strong></p>
<p>Established in 1744, Sotheby’s is the world’s premier destination for art and luxury. Synonymous with innovation, Sotheby’s promotes access, connoisseurship and preservation of fine art and rare objects through auctions, private sales and retail locations. Our trusted global marketplace is supported by a network of specialists spanning 40 countries and 50 categories, which include Contemporary Art, Modern and Impressionist Art, Old Masters, Chinese Works of Art, Jewelry, Watches, Wine and Spirits, and Interiors, among many others.</p>
<p><strong>THE ROLE</strong> </p>
<p>It is Sotheby’s responsibility to maintain the trust and respect of its clients, and in so doing retain the reputation of the Sotheby’s brand.</p>
<p>The Sotheby’s Information Security team is undergoing an exciting and strategic transformation with a major focus on safeguarding client information through our Data Protection Program; designed to introduce controls that limit data loss risk.</p>
<p>If you ever wondered why a security control even exists, and wanted to try and do it differently or better, this is the job opportunity for you. We challenge the current security mindset. We aren’t satisfied with compliance and checkboxes. </p>
<p>Sotheby’s Information Security Engineer will ensure that information remains in the hands of the right owners and is responsible for analyzing how data flows internally and externally, and will partner to deliver solutions  to reduce real risks..</p>
<p>The Information Security Engineer is accountable for the development, implementation and ongoing support of Sotheby’s Data Loss Prevention Program.</p>
<p>The Information Security Engineer will develop new ventures and work with our industry partners in the core mission of ensuring that Sotheby’s services, applications, and infrastructure are designed and implemented to the highest security standards.</p>
<p>The Information Security Engineer will ensure that key data is monitored and protected.</p>
<p><strong>RESPONSIBILITIES</strong></p>
<ul>
<li>Interface with other teams, and take a leadership role in driving internal security and privacy initiatives</li>
<li>Work with Director of Information Security, Information, Product &amp; Technology teams, and Chief Technology Officer to design and implement network and application security controls</li>
<li>Conduct quarterly business reviews to present current data security risks and initiatives to Global Compliance Counsel</li>
<li>Organize strategic initiatives to steer end users on to corporate-managed solutions, limiting shadow IT</li>
<li>Assist Sotheby’s Legal and Compliance departments with business-related security evaluations</li>
<li>Create &amp; be a stakeholder in the  incident playbook</li>
<li>Conduct proof of concepts for data security vendors including establishing requirements, design, testing, global implementation, and post-implementation maintenance</li>
<li>Improve secure engineering practices in the engineering organization</li>
<li>Conduct regular security and risk assessments of Sotheby’s applications, infrastructure, and security controls</li>
<li>Triage incidents by examining violations and partnering with the business to further investigate as needed</li>
<li>Aid internal business departments in classifying sensitive information in accordance with Information Security Policy</li>
<li>Assist in developing Learning and Development initiatives to educate users on Information Security concepts</li>
<li>Interact directly with the security community regarding vulnerabilities and threats</li>
<li>Assist in the developing Information Security Policies, Standards, and Procedures as a stakeholder and SME.</li>
<li>Participate in incident response workflows from alert to incident to post-incident review.</li>
<li>Develop security operations workflows.</li>
</ul>

<p><strong>IDEAL EXPERIENCE &amp; COMPETENCIES</strong></p>
<ul>
<li>Bachelor’s Degree</li>
<li>1-3 years of experience working in an information security capacity, with experience  in any of the following Cyber Security disciplines is a plus:</li>
<ul>
<li>Data loss prevention</li>
<li>Vulnerability management</li>
<li>Cloud security</li>
<li>Application security</li>
<li>Incident response</li>
<li>Identity &amp; access management</li>
<li>Threat Modeling</li>
<li>Vendor/Supplier management</li>
<li>Secure Configurations</li>
</ul>
<li>Knowledge of programming and scripting languages</li>
<li>Excellent communication skills</li>
<li>Prior experience with technical business applications, knowledge of IT infrastructure and IT risks and controls</li>
<li>Knowledge of IT regulatory and compliance requirements</li>
<li>Experience with CASB implementation, data classification, GDPR, and Data Loss Prevention</li>
<li>Prior experience with technical business applications, knowledge of IT infrastructure and IT risks and controls</li>
</ul>
<p><strong>Preferred Experience:</strong></p>
<ul>
<li>Has knowledge of informaiton security frameworks, best practices, and regulations (GDPR, PCI, CIS, NIST CSF, etc.)</li>
<li>Possesses one or more information Security certifications (CISSP, ISA, ISACA, SANS, etc.)</li>
<li>Has public cloud (AWS/Azure/GCP) information security experience</li>
<li>Experience with Netskope, Splunk, Okta, Crowdstrike, Tableau, Malware Bytes,Scripting (python, powershell, etc) are a plus</li>
<li>Leans with a growth mindset and question the information security status-quo &amp; ‘security theater’ that may be found elsewhere</li>
<li>Will have one or more relevant professional certifications (CISSP, SANS, CISM, or other) and will continue to grow and achieve professional goals.</li>
<li>Has demonstrated successful experience in a related area, such as security engineering or operations, management consulting, or management and has the ability to discuss and articulate more technical and complex security topics (in addition to risk management concepts and the process of risk assessments).</li>
<li>Has confidence in their expertise, but also knows who to look to for help. Achieving greater skill sets and expanding their understanding of security control techniques should be an on-going goal.</li>
<li>Understands they must gain experience in other areas of technical or operational engineering. Ongoing education to maintain their certs and challenge their expertise will motivate this person.</li>
<li>Understands workload management including understanding and seeking help prioritizing. They help others on the team that may need their leadership, but their leadership qualities enable them to also lead people outside of their team or department.</li>
<li>Is able to communicate reports to coworkers in any department and help them understand proper information security controls, especially to non-technical team mates</li>
<li>Help coworkers figure out good security controls without compromising ethics or introducing unacceptable risk.</li>
</ul><p>To view our <strong>Candidate Privacy Notice</strong> for the US, please <a href="https://www.sothebys.com/en/docs/pdf/candidate-privacy-notice.pdf" rel="noopener noreferrer nofollow ugc" target="_blank"><strong>click here</strong></a><strong>.</strong></p>
<p>To view our <strong>Candidate Privacy Notice </strong>for the UK, Hong Kong, France and Switzerland, please <a href="https://www.sothebys.com/en/docs/pdf/final-v1-sothebys-recruitment-privacy-notice-uk-hk-france-and-switzerland-31-january-2022.pdf?locale=en" rel="noopener noreferrer nofollow ugc" target="_blank"><strong>click here</strong></a><strong>.</strong></p>
<p><strong><em>The Company is an equal opportunity employer and considers all applicants for employment without regard to race (including, without limitation, traits historically associated with race, such as natural hair, hair texture, and protective and treated or untreated hairstyles), color, creed, religion, sex, sexual orientation, marital or civil partnership/union status, national origin, age, disability, pregnancy, genetic predisposition, genetic information, reproductive health decision, sexual orientation, gender identity or expression, alienage or citizenship status, domestic violence victim status, military or veteran status, or any other characteristic protected by federal, state/province or local law. The Company complies with applicable state and local laws prohibiting discrimination in employment in every jurisdiction in which it operates.</em></strong></p>

Information Security Engineer

A-LIGN

<h3>WHO ARE WE?</h3>
<p>A-LIGN is a global cybersecurity and privacy compliance solutions provider, as well as one of the fastest growing private companies in the U.S. We help our clients navigate the complexities of compliance and cybersecurity, while enhancing their information security to prevent cyber threats, reduce risk, and turn their security into a competitive advantage.</p>
<p>Our partnerships with innovative,  global organizations, of all sizes, position our employees to be exposed to a wide variety of projects with high profile clients.</p>
<h3>WHAT MAKES US DIFFERENT?</h3>
<p>A-LIGN strives to offer you every opportunity to thrive in a highly competitive industry by providing continuous training and development, access to industry SMEs, and the ability to move up quickly within the firm. At A-LIGN, you will work directly with key client stakeholders, and be trusted to define business problems and determine solutions.   You will also be responsible for ensuring business value and owning your projects by communicating results. At A-LIGN you are given the tools to be a master of your own destiny!  </p>
<p>We have eliminated time reporting and chargeability goals from our engagements and increased efficiencies in service delivery. We are pioneering a new way to approach audit, compliance, and cybersecurity. Our Staff Consultants work remotely, which will give you the freedom and flexibility to work from home, in any city!  </p>
<p>Throughout the years A-LIGN has continued to achieve new milestones as we relentlessly exceed expectations: </p>
<ul>
<li>Awarded as one of Glassdoor’s Best Places to Work!</li>
<li>Honored as an Inc. 5000 Fastest Growing Company</li>
<li>Ranked #7 on The Software Report’s Top 25 Cybersecurity Companies of 2019</li>
</ul>
<h3>HOW WILL THIS POSITION SHAPE YOUR CAREER IN AUDIT?</h3>
<ul>
<li>Gain a deep understanding of how a business works from the inside out and learn the language of business</li>
<li>Serve as a partner in audit, leaving a lasting impression with clients through collaborations and connections</li>
<li>Develop deep knowledge of technical IT audit principles and an understanding of internal controls and processes</li>
<li>Build a professional network and hone business relationship skills by working with high performing teams</li>
<li>Launch a long-lasting career path through hands-on experience, coaching, and support</li>
</ul>
<h3>TRAINING AND DEVELOPMENT?</h3>
<p>A-LIGN offers a comprehensive training program through A-LIGN University. Your Staff Consultant training will last several months and integrate classroom training, on-the-job shadowing, and personalized coaching into your professional development. A-LIGN will prepare you to be successful within our organization and in our industry!</p>
<h3>RESPONSIBILITIES</h3>
<ul>
<li>Successfully execute a variety of SOC 1/SOC 2 examinations, PCI DSS assessments, HIPAA assessments, and potentially more!</li>
<li>Strategically collaborate with management team to execute engagements</li>
<li>Contribute to methodology development and optimizing processes</li>
</ul>
<h3><strong>HOW DO WE EVALUATE CANDIDATES?</strong></h3>
<p>We are looking for individuals who can demonstrate they have the knowledge, skills, and abilities that are needed to perform their job successfully. These core competencies include:</p>
<ul>
<li><strong>Knowing My Organization</strong> – Do you demonstrate an understanding of A-LIGN’S product/service offerings? Are you able to leverage organizational values in how work is accomplished?</li>
<li><strong>Focusing on Customers</strong> – Do you understand and anticipate customer needs? Are you able to develop a positive relationship with the customers?</li>
<li><strong>Showing Resilience</strong> – Do you convey a clear sense of self-confidence to influence future events? Are you able to stay calm and composed under pressure?</li>
<li><strong>Engendering Confidence and Trust</strong> – Do you instill confidence and trust by demonstrating dependability and reliability? Do you portray trustworthiness by being open and honest?</li>
<li><strong>Processing Details</strong> – Do you ensure projects are completed on time by keeping work on schedule? Are you able to thoroughly work on tasks and provide high quality work?</li>
<li><strong>Structuring Tasks</strong> – Do you plan your work and set clear priorities? Are you able to uphold ethical standards and fulfill commitments while maintaining high levels of productivity?</li>
</ul>
<h3>MINIMUM QUALIFICATIONS</h3>
<h4>EDUCATION      </h4>
<ul>
<li>Accounting, accounting information systems (AIS), management information systems (MIS), information technology, information systems and technology</li>
<li>Other relevant degrees may be considered</li>
</ul>
<h4>EXPERIENCE     </h4>
<ul>
<li>At least 2 years of experience in IT and 2 years in Security.</li>
<li>Active membership in industry relevant club or organization such as and ISACA, AIS, WIT, and others</li>
</ul>
<h4><strong>CERTIFICATIONS</strong></h4>
<ul>
<li>A strong desire to pursue relevant industry certifications such as CPA, CISA, CISSP, C|EH</li>
<li>Currently possesses or actively pursuing relevant certifications is a plus</li>
</ul>
<h3>SKILLS</h3>
<ul>
<li>Deadline-oriented, with an exceptional degree of motivation</li>
<li>Thrives in a dynamic and fast-paced environment</li>
<li>Excellent communication skills</li>
<li>Ability to work independently as well as collaboratively</li>
<li>Driven to succeed and excited to learn new job specific skills</li>
</ul>
<p><strong>ABOUT A-LIGN</strong> </p>
<p>A-LIGN is a technology-enabled security and compliance partner trusted by more than 2,400 global organizations to confidently mitigate cybersecurity risks. We work with small businesses to global enterprises with services spanning across SOC, Penetration Testing, PCI DSS, HITRUST, ISO and privacy compliance. Our proprietary compliance management platform is transforming the compliance experience by enabling an anytime, anywhere approach to audits. For more information, visit www.A-LIGN.com. </p>

Panama

PCI Experienced Staff Consultant

OakNorth

Our vision is to promote an open, collaborative, risk-aware culture where proportionate risk management supports long-term sustainable growth. The ‘Technology and Cyber Risk’ team consists of a Director, supported by Risk Analyst(s). The team operates as specialists within a wider second line Risk team which includes Operational and Credit risk, reporting to Chief Risk Officer. We work very closely with our colleagues in the Technology and Information Security teams.
<h3>Job description</h3>
<ul>
<li>This role will specifically focus on our risk profile, in the following key areas:</li><li>Risk Assessment (60%): Risk controls are continuously tested and developed as the bank grows, embracing technology and innovation and using evolving industry best practice</li><li>Produce regular risk assessment reports of people, process, and technology systems to identify key gaps and drive process improvement</li><li>Review information security policies and procedures, with support from subject-matter experts, to ensure strategic, regulatory, and operational goals are met.</li><li>Own risk assessment and assurance with respect to third-party suppliers, partners, and mission-critical technologies</li><li>Partner with cross-functional stakeholders to document identified risks, recommend treatment options, and validate technical mitigation</li><li>Threat Intelligence (20%): Be a trusted partner to the business, providing robust, constructive challenge and helpful guidance</li><li>Assess, research, and report on cyber risks relevant to mission-critical banking operations covering people, process and technology such as threat actors, TTPs and IOCs.</li><li>Develop and refine key metrics to measure Cyber Programme maturity against best-practice baselines, security control effectiveness, and excellence of security operations execution</li><li>Where possible, apply risk management approaches to categorise and quantify exposure to evolving threats</li><li>Process Improvement (20%): Apply strong but proportionate risk controls, in partnership with the business, to protect value and to maintain stakeholder confidence</li><li>Coordinate efforts between tactical and assurance-focused teams to execute on high-visibility compliance objectives, including ongoing management of ISO standards and alignment NIST best practices.</li><li>Directly support OakNorth Bank’s Director of Technology &amp; Cyber Risk to deliver high-quality deliverables and research-based insights to the Chief Risk Officer and Board.</li><li>Review and support virtual security awareness training sessions to drive information security culture and reduce exposure to phishing, social engineering, and end-user attacks.</li></ul>
<h3>Desired skills</h3>
<ul>
<li>We are looking for experienced risk assessment professionals with a broad security knowledge:</li><li>Good general knowledge of infrastructure and application risks across cloud platforms (e.g., AWS), networks, desktop, servers and mobile. </li><li>Knowledge of security fundamentals, how they apply in real world situations, and how to gauge control effectiveness (e.g., agile development)</li><li>Experience in the practical application of information security technology, operations, and concepts – turning identified risks in actionable tasks.</li><li>Familiarity with technology and security concepts such as configuration hardening, MITRE ATT&amp;CK Framework and vulnerability management</li><li>Familiarity with UK and EU-relevant regulations relating to information security and data privacy, such as GDPR.</li><li>Excellent communication skills, particularly report writing and written communication, </li><li>Ability to translate technical language for a wider audience, and a desire to bridge communication gaps between team members, the team and management, and with the larger security community.</li><li>Ability to translate finished reports from third-party auditors and consultants into actionable risk treatment plans to adequately address findings.</li><li>Relevant degree, and/or 5+ years relevant IT audit, risk, or security experience.</li><li>Ideally, we would like to evidence advanced skills in one or more of these areas:</li><li>Specialist knowledge in infrastructure security e.g., EDR, DLP, penetration testing, technical roles</li><li>Working knowledge of AWS cloud security, or similar cloud environments.</li><li>Expertise across various security control standards and risk management frameworks, such as NIST and ISO 2700x Series</li><li>Exposure to ISO or NIST risk management and governance technologies to support complex requirements and automate evidence collection.</li><li>Advanced technical or management degree, with security specialism.</li><li>One or more relevant technical certifications: </li><li>Risk Management e.g., SANS GCCC, SANS GEVA, SANS GSNA, ISACA CISA, ISACA CRISC</li><li>Security Certifications e.g., CISSP, CISM, CEH, ISO27001 Lead Auditor</li><li>Cloud Certifications: AWS, Azure, Google Cloud</li><li>Technical Certificates: Windows, Linux, Networks, Security Products</li></ul>About UsWe’re OakNorth Bank and we embolden entrepreneurs to realise their ambitions, understand their markets, and apply data intelligence to everyday decisions to scale successfully at pace.  Banking should be barrier-free. It’s a belief at our very core, inspired by our entrepreneurial spirit, driven by the unmet financial needs of millions, and delivered by our data-driven tools. And for those who love helping businesses thrive? Our savings accounts help diversify the high street and create new jobs, all while earning savers some of the highest interest on the market.  But we go beyond finance, to empower our people, encourage professional growth and create an environment where everyone can thrive. We strive to create an inclusive and diverse workplace where people can be themselves and succeed. Our story OakNorth Bank was built on the foundations of frustrations with old-school banking. In 2005, when our founders tried to get capital for their data analytics company, the computer said ‘no’. Unfortunately, all major banks in the UK were using the same computer – and it was broken.  Why was it so difficult for a profitable business with impressive cashflow, retained clients, and clear commercial success to get a loan?  The industry was backward-looking and too focused on historic financials, rather than future potential. So, what if there was a bank, founded by entrepreneurs, for entrepreneurs? One that offered a dramatically better borrowing experience for businesses? No more what ifs, OakNorth Bank exists.  For more information regarding our Privacy Policy and practices, please visit: <a href="https://www.oaknorth.com/privacy-policy" rel="noopener noreferrer nofollow ugc" target="_blank">https://www.oaknorth.com/privacy-policy</a>

Gurugram

VP - IT &amp; Cyber risk assurance

Apply to Isaca Cyber Security Jobs in companies remotely and near you. New Isaca Cyber Security Jobs added daily.

Job Position and Company	Location	Tags	Posted
Sr. Information Security Engineer - TechOps at Leaf Group	Active Directory Auditing CISA Cissp Cobit
Information Security Program Lead at Sotheby's	AWS Azure CIA CISA CISM
Information Security Engineer at Sotheby's	Application Security AWS Azure CISM Cissp
PCI Experienced Staff Consultant at A-LIGN	Audits C CISA Cissp Hipaa
VP - IT & Cyber risk assurance at OakNorth	Agile Analytics AWS Azure Banking

Isaca Cyber Security Jobs

0 Isaca Cyber Security Jobs. Page 1 of 1

5 closed isaca cyber security jobs:

Subscribe to the weekly
Cyber Security Jobs Newsletter

Isaca Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Isaca Cyber Security Jobs

0 Isaca Cyber Security Jobs. Page 1 of 1

5 closed isaca cyber security jobs:

Subscribe to the weekly Cyber Security Jobs Newsletter

Isaca Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Subscribe to the weekly
Cyber Security Jobs Newsletter