Senior IS Risk & Compliance Analyst

Job Description Summary

The Senior Information Security Risk & Compliance Analyst will be responsible for supporting the security direction of the business and elevating the company's security posture. The Analyst is expected to support the security strategy within new and existing information systems capabilities. The Analyst's role lies within the Chief Information Security Officer's organizational structure, reporting to the Manager of Information Security Governance, Risk and Compliance.

The role oversees the business' security requirements and obligations mandated by standards and regulations. In tandem with security leadership, the GRC security analyst consistently assesses and validates the assurance of the security program. As a primary point of contact for internal and external auditors, the GRC security analyst monitors progress and enforces resolution of outstanding issues that may lead to non‑compliance or security threats to the business.

As a key member of the security team, the GRC security analyst must focus on strong risk management and corporate resiliency, and not be driven solely by compliance.

• Conduct enterprise-wide, ongoing information security risk assessments and risk management activities. Identify strengths and weaknesses in the security program. Analyze findings, and document, recommend and report program gaps to security leadership and business stakeholders; reduce risk by helping to prioritize and drive remediation efforts throughout the organization, and contribute to risk management, treatment, and reporting process efforts to protect data assets.
• Perform all ongoing compliance activities related to the implementation, maintenance, monitoring and continuous improvement of Ryder’s existing Information Security Management System (ISMS) based on the requirements of ISO/IEC 27001 International Standard as well as future compliance requirements. The analyst will work with various levels and departments across the organization to ensure appropriate documentation is maintained as evidence of competence and compliance and help to facilitate internal and external independent examinations.
  
  The analyst will also help to develop and implement an effective and unified global information technology/security compliance program with applicable data protection standards, legislation, as well as customer information security requirements.
• Perform assessments to maintain oversight of third party information technology suppliers to safeguard against undue risk. Create final reports of pros and cons, observations of anomalies, and deliverables for the business as well as mandates for supplier compliance. Articulate results of the final assessments to business stakeholders, project sponsors, program managers, and other internal parties. Assist with review of information security sections within supplier contracts to ensure security and data privacy requirements are in place.
• Evaluate the effectiveness of information security management and performance by developing, monitoring, gathering and analyzing information security and compliance metrics for management. Define qualitative and quantitative metrics to assess the success of the security program and provide regular reports to security and business leadership.
• Design and document IT general controls to ensure the business demonstrates compliance with its regulatory or compliance obligations. Facilitate and coordinate activities and responses related to internal and external controls testing including entitlement reviews. Facilitate the remediation of control gaps and elevate critical issues to management. Work closely with control owners, internal and external auditors to ensure requests are completed for timely delivery to audit.
  
  Assist with third party audits and certifications for the organization (i.e. SOC, ISO, PCI, etc.)
• Maintain oversight and administration of the GRC platform, Sensitive Data Discovery and Classification, and/or other compliance monitoring tools.
• Respond to customer information security requirements and due diligence questionnaires. Coordinate and facilitate response gathering in conjunction…