Associate Principal, Security Assurance

What You'll Do

The Associate Principal, Security Assurance is responsible for conducting various security assessments, collaborating with other security teams to assess risk and requirements for new technology onboarding and PoCs, performing third‑party security assessments to support OCC's Third Party Risk Management team, overseeing the Security Observation Risk Tracking process, and completing special risk assessments as requested by Security leadership. This role also supports other Security Assurance team members in developing these risk assessments.

Secondary responsibilities include overseeing configuration monitoring for CIS Benchmark control compliance on Windows and Linux platforms, preparing monthly reporting metrics and materials for security assurance processes, managing team request intake, and reviewing risk observations, action plans, and acceptances from Operational Risk Management processes.

• Conduct security risk assessments of OCC third parties and technologies
• Collaborate with Security Engineering & Technology Integration and Threat Intelligence teams to assess risk and set security requirements for new technology onboarding and Po Cs
• Assist with oversight of the Security Observation Risk Tracking process, including processing security observations, assessing risk ratings, communicating with risk owners, and managing the observation lifecycle
• Participate in security review and oversight of configuration monitoring for Windows and Linux platforms, including review of compliance reports for new asset builds and operating system base images
• Participate in security review and approval of Linux server privilege elevation requests
• Prepare monthly reporting metrics and materials related to the Security Observation Risk Tracking process for inclusion with other executive and Board‑audited reporting
• Assist with team request intake, such as reviewing new technology requests for risk assessment applicability
• Participate in security review and approval of risk intake, action plan, and acceptance records managed by the Operational Risk Management & Controls team
• Assist with other Security Assurance Program efforts, including tracking remediation and validating audit, compliance, and regulatory findings as needed
• Transfer technical and risk management knowledge to Security Analysts
• Perform other duties as assigned

• None

The requirements listed are representative of the knowledge, skill, and/or ability required.

• Effective oral and written communication, analytical judgment, and collaboration skills
• Analytical skills to analyze, model, and present complex risk assessments
• Ability to work independently and effectively with local and remote OCC staff, management, vendors, and consultants while exercising sound judgment
• Strong understanding of information technology, risk management concepts, and analytics
• Possesses critical OCC values (i.e., fact‑based, collaborative, credibility/trust, and judgment)

• Advanced understanding of information-related frameworks and standards such as COBIT, NIST 800‑53, NIST CSF, ISO, etc.
• Experience in security risk management principles and practices
• Experience with regulatory frameworks and requirements relevant to OCC such as Reg SCI, CFTC 99.18, etc.
• Experience working in Service Now, Tableau, Archer GRC, Jira, and Confluence

• 5 years hands‑on information security experience, preferably within compliance, audit, risk management, or security roles
• Bachelor's degree in Computer Science, Management Information Systems, Statistics & Quantitative Modeling, Mathematics, or an equivalent combination of education and/or relevant experience

• Professional network and/or security certifications are a plus, but not required (e.g., GIAC, CISSP, CISA, CISM, CRISC, AWS cloud computing)

The Options Clearing Corporation (OCC) is the world's largest equity derivatives clearing organization. Founded in 1973, OCC is dedicated to promoting stability and market integrity by delivering clearing and settlement services for options, futures and securities…