Cybersecurity Policy and Regulatory Compliance Associate Principal

PepsiCo•Plano, TX

21h

About The Position

The Cybersecurity Policy and Regulatory Compliance Associate Principal will be responsible for the management of the PepsiCo Global Cybersecurity Policy and Standards, including the proactive evaluation of the standards against industry trends, regulatory requirements, and the evolving risk landscape. The role will facilitate the annual review cycle and overall change management of policy and standards. They will be responsible for facilitating the review of change requests from PepsiCo associates, gaining alignment from stakeholders, updating the standards, and managing the review workflow to publishing. They will partner with legal and other relevant teams to review new and changing regulations and perform gap analysis against the current standards, proposing and presenting recommended changes. They will manage the end-to-end policy and standards lifecycle in ServiceNow. In addition to managing the policy and standards life cycle, the role will include cybersecurity regulatory consulting and compliance to ensure adherence to relevant cybersecurity requirements. They will partner with global cybersecurity, business, and S&T teams to advance the knowledge of security requirements and the use of cybersecurity processes and capabilities. They will lead periodic regulatory engagements to test and report on the compliance of cybersecurity controls.

Requirements

Technical and business expertise to drive Cybersecurity requirement
In-depth technical experience and knowledge of infrastructure technologies, network, web, computing, cloud services, manufacturing equipment, mobile devices, and information (cyber) security, allowing this role to provide technical leadership and coaching to other members of the organization
Strong understanding of business needs and commitment to delivering high-quality, prompt, and efficient service to the business, allowing them to meet their strategic objectives
Strong verbal and written communication skills that positively impact relationships with key business and third-party stakeholders, and proactively influence the actions taken by these stakeholders
Comprehensive technical and functional understanding of various Cybersecurity solutions, technologies and industry-leading practices, allowing this role to provide recommendations and support key decisions.
Proficient in ServiceNow IRM, Microsoft Excel, Word, and PowerPoint skills to develop ad hoc reports to manage the reports and the metrics.
Knowledgeable of Security controls and requirements for broad IT system types (e.g., Cloud, Database, Network, etc.)
Independent thinker and strong self-motivator, with the ability to collaborate with virtual teams and influence decision-making
Strong understanding of business needs and commitment to delivering high-quality, prompt, and efficient service to the business, allowing them to meet their strategic objectives.
Strong verbal and written communication skills that positively impact relationships with key business and third-party stakeholders, and proactively influence the actions taken by these stakeholders.
Excellent prioritization capabilities, with an aptitude for breaking down complex work into manageable parts, effectively assessing the priority and time required to complete each part
An ability to work on several tasks simultaneously
Strong decision-making capabilities, with a proven ability and common sense to weigh the relative costs and benefits of potential actions and identify the most appropriate one
Strong ability to effectively influence others and lead peers and superiors to modify their opinions, plans, or behaviors, with an emphasis on collaborating across multiple teams and ensuring program needs are satisfied through interpersonal and trusted communication
Effective ability to identify and assess the severity and potential impact of risks, and communicate risk assessment findings to risk owners outside Cybersecurity. Communication should consistently drive objectives, relying on fact-based decisions about risk that optimize the trade-off between risk mitigation and business performance.

Responsibilities

Manage end-to-end PepsiCo Cybersecurity Policies and Standards lifecycle
Maintain in-depth and up-to-date knowledge of industry cybersecurity trends, policy/control frameworks and regulations; especially the NIST Cybersecurity Framework, CIS, ISO 27001 and other industry frameworks
Maintain extensive knowledge of PepsiCo Cybersecurity Policy and Standards, including the global applicability and limitations of the standards
Monitor the external global regulatory landscape for emerging, new or changing cybersecurity regulations that may impact PepsiCo
Evaluate cybersecurity regulations against PepsICo policies, processes and controls to determine the impact of regulatory changes
Lead various periodic cybersecurity regulatory assessments and engagements to determine PepsiCo compliance with cybersecurity regulatory requirements.
Collaborate with Cybersecurity and IT Controls team to ensure updates to standards and regulatory requirements are reflected in updated controls
Proactively identify and recommend necessary changes to the security policy and standards
Coordinate with Cybersecurity teams, including Business Information Security Officers, Policy and Standards and others to establish an operating model communicating to/from local teams impacted by new and emerging regulations
Consult in the design of security solutions, processes, or policies to ensure global regulations are prioritized in the development of requirements
Develop/Maintain metrics on standards to allow for the identification of risks
Partner with the Security Exceptions team to identify exception patterns and recommend adjustments to standards as needed to create efficiencies within the process
Collaborate and align with Cybersecurity and IT teams on changes and additions to standards
Communicate with PepsiCo Leadership on the interpretation and application of the policies or standards
Manage workflow in ServiceNow for annual and out-of-cycle review and changes
Work with the ServiceNow development team to identify opportunities for process/tool improvement
Provide subject matter expertise on the application of PepsiCo Policy and Standards with IT processes