Information Security Assurance Analyst I

Global Payment Holding Company•Jeffersonville, IN

About The Position

Provides technical guidance on information security policies, procedures, technologies, and compliance-related activities by performing First Line Assurance assessments. Works with Information Security, Technology, Risk, Audit, and business stakeholders to validate security control implementation and effectiveness, identify vulnerabilities and control gaps, support remediation, and contribute to certification, continuous monitoring, and automation programs. The role supports an automation-first model for control audits, evidence collection, reporting, certification, and continuous monitoring. It helps create workflows, dashboards, data collection, and repeatable assessment processes that reduce manual effort and increase assurance coverage. Power Automate, Power BI, and similar workflow and reporting technologies are desirable. The position works on issues affecting security assurance, technology risk management, control effectiveness, automation, reporting, and future concepts, products, or technologies. It creates formal networks with key decision makers and serves as a trusted partner to Information Security, Technology, Risk, Audit, and business stakeholders. The role exercises wide latitude in determining objectives and approaches to critical assignments.

Requirements

Bachelor's and/or master's degree in Computer Science, Information Security, or a related information technology field, and/or a combination of equivalent and relevant work experience.
Minimum 7 years of relevant experience in information security, security assurance, audit, risk, compliance, security architecture, security engineering, or related technology functions.
Knowledge of industry-standard security and compliance programs and frameworks, including PCI, FFIEC, FISMA, SOX, GLBA, HIPAA, ISO 27001 (listed as ISO-87001 in the posting), NIST 800-53, NIST CSF, NIST RMF, and/or related security control frameworks.
Ability to work with stakeholders at multiple levels to identify risk, collect and evaluate evidence, document findings, and communicate practical remediation options.
Strong familiarity with on-premises, cloud, and hybrid environments, including connected and disconnected environments, in a complex and diverse Fortune 500 organization.
Experience performing information security assessments, security control assessments, technical control testing, control design testing, control effectiveness testing, KPI/KRI testing and validation, operational assurance reviews, or post-deployment validation activities.
Knowledge of continuous monitoring, control validation, compliance automation, evidence collection, and remediation tracking concepts.
Strong analytical, communication, and stakeholder management skills, with the ability to translate technical evidence into business-focused recommendations.
Broad and in-depth expertise to support company objectives and goals in complex environments; ability to take ownership of a function, major account, or matrix-management responsibilities and lead matrix teams on complex projects.

Nice To Haves

Professional certifications such as CRISC, CGRC, CISM, CISSP, CISA, CySA+, or equivalent experience are preferred.
Familiarity with multiple cloud hosting environments, or strong familiarity with at least one major cloud provider environment such as GCP, AWS, or Azure.
Experience designing, implementing, or supporting automated security control validation processes, tooling, and infrastructure, including strategic and continuous monitoring, audit resiliency, and/or evidence collection processes.
Experience with the Microsoft Power Apps Platform, including Power Automate and Power BI, or other metrics and reporting data structures.
Experience developing dashboards, metrics, assessment reports, or recurring assurance reporting from multiple data sources.
Familiarity with workflow automation platforms such as ServiceNow and assessment or evidence tracking platforms such as Optro (formerly AuditBoard), Archer, or similar audit/GRC tools.

Responsibilities

Collaborate with Information Security, Technology, Risk, Audit, and business stakeholders to support First Line Assurance objectives, align assessments with business priorities, and communicate findings clearly.
Perform targeted control assessments, operational assurance reviews, post-deployment security validations, and certification activities.
Evaluate security control implementation and effectiveness; identify control weaknesses and compliance gaps; assist with remediation tracking; and provide detailed findings and recommendations.
Support automation of control audits, evidence collection, control testing, reporting, remediation tracking, certification, and continuous monitoring.
Contribute to workflows, dashboards, data collection, and repeatable assessment processes that reduce manual effort and increase assurance coverage.
Use automation and reporting tools to streamline evidence collection, control validation, assessment execution, remediation tracking, and recurring assurance activities.
Support continuous monitoring, assurance, and validation by reviewing technical, administrative, and operational security controls.
Analyze assessment results, assist in developing automation opportunities, track remediation efforts, and contribute to recurring certification and reporting activities.
Review business requests, assurance findings, and control exceptions to determine risk level and appropriate remediation paths.
Inform management of security policy variances and control gaps.
Perform other duties as assigned.