Associate Director, IT Security | Pen Testing

Note: This position follows our hybrid-friendly schedule, so you get the best of both worlds - flexibility and collaboration. In office days will be 2-3 per week averaging 10-12 days per month in one of the following locations: St Petersburg, FL; Denver, CO; Memphis, TN; or Southfield, MI.

Job Summary:

As part of the Technology Risk and Assurance division, the Associate Director will lead the security assurance program, which focuses on penetration testing and other security assessments to inform the firm's security posture. The role will be responsible for vendor interactions including overseeing security assessments and validating reports. Implements and maintains on-going programs and processes to test the design and operational effectiveness of IT controls. Responsible for ensuring IT assurance and compliance-related activities are completed following industry standards and regulatory requirements. Demonstrates subject matter expertise and is able to integrate domain knowledge with an understanding of financial services standards and practices. Is the primary on the most complex or escalated issues and may provide direction and guidance team members. Applies specialized business knowledge and technical skills to significant deliverables and projects that involve multiple IT departments, and business units and have enterprise impact. This role will manage a small team (3-5 associates) who primarily focus on penetration testing.

Essential Duties and Responsibilities:

• Seeks understanding of security risks and develops plans for assessing controls in place to address those risks.
• Represent CISO and Information Security organization internally and externally as lead for the penetration testing program.
• Serves as an information risk and control advisor, participating in IT processes and activities (e.g., planning, systems development and product selection, etc.).
• Advises process owners on design and implementation of IT controls (manual and automated) into processes and systems using knowledge of risks and company objectives.
• Identifies, implements, and maintains processes and tools to support assurance, and compliance, and remediation tracking activities (e.g., testing, maintenance of controls documentation).
• Maintains IT controls-related documentation (e.g., narratives, process flows, RCM) for simple to complex information systems in support of information assurance and compliance activities.
• Analyzes controls for adequacy of design and performs and/or supports control assurance testing activities.
• Assists IT process owners in the creation and maintenance of IT policies and procedures to support information assurance and regulatory compliance activities, by providing input on control objectives and activities.
• Works closely with internal and external auditors, regulators, and examiners, including coordination and compilation of technology documentation requests, reports, and assurance letters to ensure IT compliance.
• Performs other duties and responsibilities as assigned.

Employers have access to artificial intelligence language tools (“AI”) that help generate and enhance job descriptions and AI may have been used to create this description. The position description has been reviewed for accuracy and Dice believes it to correctly reflect the job opportunity.