Governance, Risk and Compliance Analyst

at  ION Group

KNOWLEDGE OF:

• Working within the technical financial services industry, or other highly regulated industries
• Information security management, governance, and compliance principles, practices, laws, rules and regulations, e.g. NIST, ISO, NIS, DORA and GDPR;
• Information technology systems and processes, network infrastructure, data architecture, data processes and protocols;
• Cyber and cloud security standard frameworks, architecture, design, operations, controls, technology, solutions, and service orchestration, e.g. CIS, CSF;
• Information systems auditing, monitoring, controlling, and assessment process;
• Incident response management, e.g. ITIL;
• Risk assessment and management methodology, e.g., NIST, ISO 27005;
• Security training techniques and reporting activities.

SKILLS IN:

• Developing and implementing enterprise governance, risk, and compliance strategy and solutions;
• Researching and understanding security information related to internal and external organizations using online and other sources;
• Management of technology vulnerability and threat information;
• Security project management and planning;
• Risk management, information security and audit management lifecycles

ROLE DESCRIPTION

• Support and advise on management of information security and associated controls;
• Support and advise on management of risk and provide a transparent view of risk posture to stakeholders;
• Support and advise on compliance with relevant control standards, regulation and audit requirements;
• Responsible for the oversight and monitoring of risk in line with the ISMS;
• Collaborates with security and audit teams to ensure controls are operating in line with policies.

KEY TASKS

As part of the Governance, Risk and Compliance Team within ION Markets, the resource will deal with the following activities:

• Document and monitor risk and control environment to identify existing and emerging risks and issues;
• Evaluate and document issues related to changes in the risk environment and risk priorities;
• Identify and aggregate thematic risk related to findings and trends, e.g. regulatory preparedness, thematic concerns;
• Engage Internal Audit to discuss risk posture and audit inputs;
• Communicate heightened risk that is relevant to stakeholders and customers to ensure transparency and appropriate prioritization for remediation;
• Understand legal and regulatory obligations relevant to the product and how the processes and associated controls provide evidence of compliance;
• Partner with business stakeholders to respond to customers, external audit and regulatory requests for information;
• Educate and advise on security policy, standards and procedures;
• Manage and maintain external certification activities.