Senior Cybersecurity Governance Specialist

Overview

Leads the team in providing strategic security leadership and assurance to business and IT teams for major corporate initiatives and information security projects. Develops the strategy in how Western & Southern Financial Group (W&SFG) performs risk assessments, security assessments and policy reviews of WSFG systems and third-party vendors to identify areas of noncompliance with established information security standards and regulations. Manages the recommendations and coaches the team on mitigation strategies and countermeasures.

Provides guidance to IT stakeholders in the evaluation, design or implementation of secure computing environments including vulnerability management. Works with Cybersecurity Risk Management team in driving improvements in the information security policy framework. Manages the development, review and monitoring of information security policies and procedures, and develops and communicates improvements. Identifies and defines overall security requirements for the proper operation and design of business and IT applications to ensure the protection of W&SFG systems and data.

Leads the development of the organization's information security awareness program. Escalates when needed and updates Director on a regular basis.

What you will do;

• Consults and/or executes third-party vendor due diligence security reviews to ensure compliance with information security policy, security procedures and regulatory requirements. Identifies and reports deficiencies or risks to the appropriate stakeholders. Follows up with business teams and third parties to escalatie issues when necessary.

• Plans and executes security assessments and penetration testing. Leads effort to address identified IT audit findings and cybersecurity risks with corrective action plans. Develops the strategy and drives process/program improvements with IT leadership and compliance teams. Conducts ongoing monitoring of the first-party security posture and performance. Acts as a liaison with Internal Audit on IT audits.

• Works with stakeholders to plan, develop and deploy a comprehensive vulnerability management program to govern cybersecurity risk to the enterprise. Builds effective relationships with stakeholders who own and support applications, IT infrastructure and operations to review exposure to threats and drive risk reduction measures. Establishes and tracks performance metrics and provides regular updates to IT leadership on the status of the vulnerability management program.

• Leads efforts with project teams to ensure PMLC/SDLC tollgates are being met for security and that the appropriate security artifacts are being maintained. Plans and develops strategy to ensure security is incorporated into the PMLC/SDLC. Makes certain it assesses the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction in order to provide confidentiality, integrity and availability.
  
  Develops key performance indicators to measure overall effectiveness and reduction of risk.

• Conducts in-depth research to understand industry best practices, emerging trends and the latest open source methods. Leads in developing practices and standards that inform design and deliver high-quality solutions that will help address current security challenges and enable new ways of delivering value to the Enterprise.

• Provides leadership to IT and the business with minimal supervision serving as a technical security consultant. Acts as a key contributor to solve complex business problems and deliver solutions that help avoid risks to corporate network and information assets. Ensures the appropriate level of controls are applied based on industry standards, best practices and cybersecurity regulations by developing repeatable processes to identify, evaluate, and measure IT security risk.

• Plans and delivers training and/or mentoring advice to team members and other IT groups on security topics, risk avoidance, and security best practices.

• Plans and manages the information security policy lifecycle, including policy creation, policy maintenance, policy exception,…