Chief Information Security Officer

PRA Group (Nasdaq: PRAA) • Norfolk, VA

1d • $194,600 - $324,400

About The Position

Secure access to information assets is critical to achieve business objectives. The CISO is responsible for establishing and maintaining the information security program to ensure that information assets and associated technology, applications, systems, infrastructure and processes are adequately protected in the cloud and digital ecosystem in which we operate. The CISO is responsible for identifying, evaluating and reporting on legal and regulatory, IT, and cybersecurity risk to information assets, while supporting and advancing business objectives.
The CISO will proactively work with business units across PRA and ecosystem partners to implement practices that meet agreed-on policies and standards for information security. He or she should understand IT and must oversee a variety of cybersecurity and risk management activities related to IT to ensure the achievement of business outcomes where the business process is dependent on technology. The CISO will be responsible for implementing and running the enterprise information security program.
The CISO should understand and articulate the impact of cybersecurity on business and be able to communicate this to all senior stakeholders (including BOD). He or she serves as the process owner of the appropriate second-line assurance activities not only related to confidentiality, integrity and availability, but also to the safety, privacy and recovery of information owned or processed by the business in compliance with regulatory requirements. The CISO understands that securing information assets and associated technology, applications, systems and processes in the wider ecosystem in which the organization operates is as important as protecting information within the organization's perimeter.
While the CISO is the leader of the information security program, he or she must also be able to coordinate disparate drivers, constraints and personalities, while maintaining objectivity and a strong understanding that cybersecurity is foundational for the organization to deliver on its business goals and objectives. Ultimately, the CISO is a business leader, and should have a track record of competency in the field of information security and/or risk management, with seven to 10 years of relevant experience, including five years in a significant leadership role.

Requirements

• Minimum of seven to 10 years of experience in a combination of risk management, information security and IT or OT jobs (at least five must be in a senior leadership role)
• Sound knowledge of cloud environments with an ability to apply security as needed across cloud platforms.
• Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical audiences at various hierarchical levels, ranging from board members to technical specialists
• Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies
• Up-to-date knowledge of methodologies and trends in both business and IT (Cloud)
• Proven track record and experience in developing information security policies and procedures, as well as successfully executing programs that meet the objectives of excellence in a dynamic business environment
• Must be a critical thinker, with strong problem-solving skills
• Knowledge and understanding of relevant legal and regulatory requirements, such as: Gramm-Leach-Bliley Act (GLBA), General Data Protection Regulation (GDPR), California Consumer Protection Act, Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry/Data Security Standard (PCI).
• Project management skills: financial/budget management, scheduling and resource management
• Ability to lead and motivate the information security team to achieve tactical and strategic goals, even when only "dotted line" reporting lines exist
• A master of influencing entities and decisions in situations where no formal reporting structures exist, but achieving the desirable outcome is vital
• Degree in business administration or a technology-related field, or equivalent work- or education-related experience
• Excellent stakeholder management skills
• High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity

Nice To Haves

• Professional security management certification is desirable, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials.
• Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT as well as those from NIST, including 800-53 and Cybersecurity Framework

Responsibilities

• Establish Governance and Build Knowledge: Facilitate an information security governance structure through the implementation of a best practice governance program. Providing regular reporting on the current status of the information security program to technology and senior business leaders and the board of directors (as required) as part of a strategic enterprise risk management program, thus supporting business outcomes.
• Work with the vendor management office to ensure that information security requirements are included in contracts by liaising with vendor management and procurement organizations.
• Create and manage a targeted information security awareness training program for all employees, contractors and approved system users, and establish metrics to measure the effectiveness of this security training program for the different audiences.
• Provide clear risk mitigating directives for projects with components in IT, including the mandatory application of controls.
• Lead the Organization: Lead the information security function across the PRA to ensure consistent and high-quality information security management in support of the business goals.
• Determine the information security approach and operating model in consultation with stakeholders and aligned with the risk management approach and compliance monitoring of nondigital risk areas.
• Manage the budget for the information security function, monitoring and reporting discrepancies.
• Set the Strategy: Develop an information security vision and strategy that is aligned to organizational priorities (Connect 5) and enables and facilitates the organization's business objectives, and ensure senior stakeholder buy-in and mandate.
• Develop, implement and monitor a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy and recovery of information assets owned, controlled or/and processed by the organization.
• Assist with the identification of non-IT managed IT services in use ("business side IT") and working with owners to apply standard controls and rigor to these services. Conducting annual Sys Admin training.
• Work effectively with business units to facilitate information security risk assessment and risk management processes and empower them to own and accept the level of risk they deem appropriate for their specific risk appetite.
• Develop the Frameworks: Develop and enhance an up-to-date information security management framework based on the following: International Organization for Standardization (ISO) 2700X, ITIL, COBIT/Risk IT and National Institute of Standards and Technology (NIST) Cybersecurity Framework.
• Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines. Oversee the approval and publication of these information security policies and practices.
• Partner with CDO on the creation of a framework (DMBOK) for roles and responsibilities about information ownership, classification, accountability and protection of information assets.
• Build the Network and Communicate the Vision: Provide input for the IT section of the company's code of conduct.
• Create the necessary internal networks among the information security team and line-of-business executives, corporate compliance, audit, physical security, legal and HR management teams to ensure alignment as required.
• Build and nurture external networks consisting of industry peers, ecosystem partners, vendors and other relevant parties to address common trends, findings, incidents and cybersecurity risks.
• Liaise with external agencies, such as law enforcement and other advisory bodies, as necessary, to ensure that the organization maintains a strong security posture and is kept well-abreast of the relevant threats identified by these agencies.
• Liaise with the enterprise architecture team to build alignment between the security and enterprise (reference) architectures, thus ensuring that information security requirements are implicit in these architectures and security is built in by design.
• Operate the Function: Work with the compliance staff to ensure that all information owned, collected or controlled by or on behalf of the company is processed and stored in accordance with applicable laws and other global regulatory requirements, such as data privacy.
• Collaborate and liaise with the data privacy officer to ensure that data privacy requirements are included where applicable.
• Ensure that security is embedded in the project delivery process by providing the appropriate information security policies, practices and guidelines.
• Manage and contain information security incidents and events to protect corporate IT assets, intellectual property, regulated data and the company's reputation.
• Monitor the external threat environment for emerging threats and advise relevant stakeholders on the appropriate courses of action.

Benefits

• performance based bonus programs
• equity programs
• paid time off
• medical
• dental
• vision
• 401k match
• life insurance
• other benefits to assist with the physical and mental wellbeing of our employees

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Associate degree