Manager of Information Security

Area

The Information Security department is responsible for setting enterprise security policies and standards that are designed to protect the confidentiality, integrity and availability of Morningstar information. The security team offers guidance and technical expertise in areas such as application security, policies and procedures, disaster recovery, and compliance/regulation. We analyze emerging security threats and conduct risk and vulnerability assessments to ensure that our information remains secure.

The IT Compliance Manager’s primary focus is to lead and manage the Information Security Compliance team’s effort and activities to ensure information security compliance, privacy and protection across Morningstar. This individual will act as a liaison between Information Security and the Business regarding compliance related issues and activities, execute compliance status reporting and metrics, lead the third‑party risk management program, lead internal and external IT auditing processes, monitor information security and IT processes for compliance and policy issues and collaborate on risk vulnerability assessments.

Provides technical expertise in all aspects of enterprise information security compliance for all applicable regulations. This role requires an individual who is well rounded – an exceptional multitasker, an effective communicator, proactive, analytical and detail‑oriented, possessing both strong technical and business skills and who operates well under pressure. This position is based in either our Chicago or Toronto office.

• Lead, manage and support Morningstar’s current and future compliance related responsibilities (SOX, SOC2, PCI)
• Monitor and enforce compliance to information security and compliance policies and standards
• Execute audit tests; identify issues and areas for improvement in efficiency and effectiveness of information technology operations
• Document and manage security / policy / compliance exceptions where necessary
• Manage periodic reviews of security policies, processes and procedures
• Lead and manage the third‑party risk management program
• Conduct relevant contract reviews for client security contracts
• Lead and directly manage a team of information security compliance analysts
• Liaise with Morningstar’s third‑party audit personnel, including internal, external, and client auditors and facilitate audits as required
• Ensure Morningstar processes are efficient and effective, and procedures are up‑to‑date, relevant, and adhere to compliance standards
• Plan, present and drive the strategic information security compliance program for Morningstar

• Minimum bachelor’s degree and 5+ years’ experience in a risk, compliance or IT auditor role
• Strong leadership and team development skills, with experience managing cross‑functional and global teams
• Excellent communication skills and familiarity with common compliance standards (SOX, SOC2, PCI‑DSS, GDPR, SEC, etc.)
• Demonstrated knowledge and experience in implementing governance frameworks and security risk management processes, such as NIST, ISO, and COBIT guidelines and standards
• Strong organizational skills and ability to multitask and switch priorities with short notice
• Strong business analysis, research and analytical skills
• Availability to work off business hours as required
• Preferred relevant security certifications (CISSP, CISM, or CIPP)
• 3+ years’ experience directly managing personnel, including hiring, developing, motivating, and directing people as they work

Total Cash Compensation Range (base + bonus): $147,550 – $265,575.

• Financial Health – 100% 401(k) match up to 6% of salary; stock ownership potential; company‑provided life insurance – 1× salary + commission
• Comprehensive health benefits (medical/dental/vision) including potential premium discounts and company‑provided HSA contributions (up to $500–$2,000 annually) for specific plans and coverages; additional medical wellness incentives – up to $300–$600 annually; company‑provided long‑ and short‑term disability insurance
• Emotional Health – trust‑based time off, 6‑week paid sabbatical program, 6‑week paid family…