Information Assurance Manager

JBA•Nashville, TN

About The Position

The Manager of Information Assurance is responsible for identifying and documenting Information Technology (IT) risks, analyzing vendor and supplier risk, sharing the Pillsbury security-related activities with customers, and ensuring Pillsbury’s continued compliance with relevant standards (GDPR, SOC2, SOX etc.). This role’s primary objective is to oversee the enterprise information assurance program. The Manager plays an important role in the Information Security team's global mission. The manager is a hands-on, high energy, and collaborative leader who can balance the intent of security policies with productivity and value generation. The successful candidate will have deep cybersecurity, technology, audit and risk management expertise, and will work closely with the Director of Security and Continuity. They will be asked to innovate on the existing audit processes and create a modern audit program that reduces the difficulty of complying with multiple audit standards. This position will also be a key leader in and help continue to mature the existing Third-Party Risk Management (TPRM) program. The manager will lead client information security inquiries, audits and will direct matrix team members as required. The ideal candidate will create and manage Key Performance Indicators (KPI's) and Key Risk Indicators (KRI's) with the Director of Security and Continuity and the firm Enterprise Risk Management function. This role will be expected to conduct high-level presentations to senior executives, while also being able to communicate on a technical level. The ideal candidate is a highly motived but compassionate leader, who has a strong desire to advance their career and build a high-energy, modern Governance, Risk and Compliance (GRC) program.

Requirements

Bachelor's degree in a related field or equivalent experience
7+ years of experience in information security
A minimum of 5 years of experience in cyber risk management
3+ years management experience for information security, risk management and compliance activities
Professional certifications (CISSP, CISA, CISM or CASP)
Deep knowledge of SOC 1, SOC 2 compliance requirements
Background as a technologist, with a deep understanding of application development and DevOps
Understanding of risk assessment methodologies, frameworks, and industry standards: E.g., ISO 27001, NIST, FEDRAMP
Proven ability to understand and interpret legal, regulatory and contractual compliance requirements
Strong leadership skills
Attention to details
Ability to influence business partners with a firm strategic view
Proven project management skills
Ability to build relationships
Excellent verbal and written communication skills

Responsibilities

Leading a cross-functional team of information security professionals with wide-spread responsibility
Coordinating data-driven risk assessments and risk-based analysis of controls
Conducting industry benchmarking, regulatory requirement gathering and peer-based analysis of available controls, risk assessment methodologies and risk mitigation practices to assess for coverage gaps
Assisting in the development of information security and information technology metrics (e.g. KRIs and KPIs) to continuously monitor and oversee program level risks
Provide periodic updates, reports, and recommendations to management, regarding best practice information security and information technology controls, risk assessment and remediation strategies
Advocate for the cyber security program and evoke cooperation across business units
Build and maintain relationship with various stakeholders
Streamline and create audit efficiencies to manage client audits and other regulatory audit activities
Partner with Cybersecurity Operations Center Manager to implement security measures to protect computer systems, networks, and data
Assist in creating, testing, and implementing disaster recovery plans
Support other Information Security initiatives, as assigned