Title: Risk Compliance & Governance Lead
Requisition ID:
15458
City:
Tokyo
Country/Region:
JP
Job Description
Role Purpose
The purpose of the role is to lead and manage security requirements and recommend specific improvement measures that helps maintain the Security posture of organisation
͏
Job Title: Information Security Audit Engineer
This role will drive the execution of global SaaS compliance and certification strategy using common Cloud Controls Framework (CCF) to meet customer and regulatory demands and enable global market access
Responsible for:
- Partner with our clients to enable ISMAP Certification and more for SaaS offers
- Leverage commonalities between major certification programs to design, implement and drive adoption of Cloud Controls Framework (CCF)
- Support and drive the adoption of core services that together constitute a Common Security Tooling Stack
- Implement governance and tracking of Cisco SaaS offers Compliance targets
- Create and maintain centralized governance functions, e.g., information security and business continuity steering committees, risk assessments, policy/standards/exception management programs, etc. Using a hub (S&TO) / spoke (SaaS Offers) model
͏Skills
- proven track record in related field such as IT Audit, GRC, etc.
- Hand on experience with AWS and other cloud environments
- Knowledge of Compliance frameworks is a must (e.g., ISMAP, SOC2, ISO)
- Knowledge of Core IT processes / services such as SDLC, Identity/User Access management, Vulnerability Management, Backup and DR processes will be useful
- Bachelors Degree with a focus in Information Technology / Computer Science or related field
- Excellent communications skill at all levels of the organization
- Ability to prioritize in a fast-changing environment
- Ability to balance multiple programs
- Excellent analytical skills
- It’s critical that the person is a good team-player
- Relevant certifications like CISA, CISSP, CCSK, others, will be a plus.
͏
Deliver
No. | Performance Parameter | Measure |
1. | Adherence to established risk and compliance framework | Reported incidents, no. of major security incidents, cost per incident, meeting regulatory requirements, appropriate management of customer impact, mean time to detect (MTTD), mean time to resolve (MTTR), cyber security training |
2. | Disaster recovery | Disaster recovery |
͏