Analyst, Information Security Risk

The Clearing House • Raleigh, NC

47d • Hybrid

About The Position

Technology and Information Security Risk Management (TISRM) group is looking for a Information Security Risk Analyst as a direct report to the Director of Information Security Risk Management. In this role, the candidate will be responsible for assessing information security risks across the organization. The individual will perform risk assessments and enhance the continuous Information Security risk monitoring program. The Clearing House (TCH) is a banking association and payments company that is owned by the largest commercial banks in the United States. TCH owns and operates the core payments system infrastructure in the US and is currently working to modernize that infrastructure by launching a new, ubiquitous, real-time payment system. TCH is the only private-sector ACH and wire operator in the US, clearing and settling nearly $2 trillion in US dollar payments each day, representing half of all commercial ACH and wire volume. TCH has provided critical services to the banking industry since 1853, and today, our core products facilitate services including Direct Deposit of payroll, bill payments, and check image exchange. The Clearing House operates U.S-based payments networks that clear and settle more than $2 trillion each day through wire, ACH, check image, and real-time payments. It is the nation’s most experienced payments company, with a long track record of providing secure and reliable systems, payments innovation, and strategic thought leadership to financial institutions. In 2017, The Clearing House revolutionized U.S. payments by introducing the RTP® network, which supports the immediate clearing and settlement of payments, along with the ability to exchange related payment information across the same secure channel. These RTP capabilities enable all financial institutions to offer safer, faster, and smarter digital transaction services for their corporate and retail customers. Learn more at www.theclearinghouse.org.

Requirements

• Bachelor’s degree in risk management, business administration, management information system, mathematics, finance, economics, or a related area.
• 2-3 years of experience performing risk assessments, e.g., RCSA.
• Ability and eagerness to understand (at a high level) existing and emerging technologies, and to work with technical teams in a liaison-like capacity.
• Ability to understand management objectives, risk appetite, tolerances, and impact of changes to risk profiles.
• Maintain current knowledge of new regulations and emerging industry risks and report potential and/or actual enterprise impact to management.

Nice To Haves

• Familiarity with IT governance and controls, including governance and control frameworks, such as COBIT, ITIL, FFIEC, COSO or equivalent is a plus, but not required.
• Extremely Strong analytical and problem-solving skills.
• Ability to work with all levels within the organization.
• Ability to work independently and proactively.
• Collaborative, innovative, resourceful, results oriented, with appropriate judgment.

Responsibilities

• Perform information security risk assessments across the organization to ensure information security risks are identified, assessed, quantified, appropriately mitigated and managed through the lifecycle of the product and/or service.
• Draft reports which include information security metrics (KRI/KPI), program status, information security risk profile(s), risk acceptances and other information to provide a holistic picture of Information Security Risk of the organization.
• Perform periodic/ad-hoc reviews/testing to determine if information security controls are operating effectively.
• Escalate issues to appropriate levels within organization
• Stay current in technology specific information security risk management techniques, industry best practices, and regulatory requirements, as well as specific areas of information security risk.
• Perform Information Security risk assessments of technology enabled projects; activities include vendor reviews, security requirement definition, and facilitation of security testing and management of residual risk
• Perform vendor security risk assessment activities that include evaluation of vendor controls and practices, process enhancements, performing on site assessments, reviewing security test reports, and analyzing and developing security requirements

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Number of Employees: 251-500 employees