Risk & Security Officer II

Who Are We?

Taking care of our customers, our communities and each other. That’s the Travelers Promise. By honoring this commitment, we have maintained our reputation as one of the best property casualty insurers in the industry for over 170 years. Join us to discover a culture that is rooted in innovation and thrives on collaboration. Imagine loving what you do and where you do it.

Technology

The annual base salary range provided for this position is a nationwide market range and represents a broad range of salaries for this role across the country. The actual salary for this position will be determined by a number of factors, including the scope, complexity and location of the role; the skills, education, training, credentials and experience of the candidate; and other conditions of employment.

As part of our comprehensive compensation and benefits program, employees are also eligible for performance-based cash incentive awards.

$ - $

1

At Travelers, Our Risk & Security Officers assess internal and external cyber and tech risks and design, test, and monitor the operational effectiveness of cyber and tech controls at Travelers and key third parties. They identify opportunities to improve cyber and tech posture, assist in recommending and prioritizing risk-based remediations, and monitor and report completion. Risk & Security Officers provide assurance of internal governance practices and training and awareness of cyber and tech policy changes.

As an Risk & Security Officer II, you are the point person for an assigned business area and/or enterprise function that identifies and analyzes multiple processes for cyber and tech risks. You will assess the associated controls for design and operational effectiveness. You will communicate the results of your work with business customers and, if applicable, third-party contacts. Leveraging your technical expertise, you will effectively convey the risk and business implications of any observations and make recommendations to enhance controls or processes.

You will lead projects that have impacts across the department and enterprise.

• Execute control assessments across all lines of business. Assessments will primarily focus on access controls, but may include other detailed reviews.
• Owns a portfolio and/or business area which includes the review and work assignments for risk, policy, and/or cyber risk posture; analyze and assign cyber risk posture for more complex risks.
• Make recommendations for process improvement within assigned lines of business.
• Strategically lead risk discussions across portfolio and drive standardized cyber and tech control processes and procedures.
• Recommend cyber and tech controls across multiple third party platforms (i.e., cloud, network, and endpoint control fundamentals) to create a solution that assures risk mitigation.
• May coordinate efforts to enable solution across lines of business for enterprise benefit.
• Identify trends and areas of improvement.
• Proactively identify cyber and tech risks and areas of non-compliance and recommend solutions.
• Educate and train business partners on risks and compliance concepts.
• Perform other duties as assigned.

• Degree in Computer Science, Technology Auditing, or related field.
• 5 years’ experience in a risk management, audit, computer networking, network security or related role.
• COMPTIA, Security+, CRISC, CISSP, CISA or related cyber certification and/or pursuing a CISSP designation.
• Knowledge of compliance concepts (i.e., PII, GDPR, PIPIDA, PCI DSS, FTC) in order to apply them to real world problems and identify gaps.
• Deep technical knowledge of key security frameworks and assessments (SIG, SANS, NIST, PCI, SOC2, COBIT, SOX, ISO
  2700) and security principles and methods.
• In‑depth understanding of Cloud, Network, Endpoint (etc.) controls and how the controls inter‑play within a control environment.
• Excellent communication skills with the ability to consult on projects and present information effectively.
• Ability to manage multiple projects simultaneously and follow through to…