Information Security Risk and Compliance Senior Analyst

Wawa, Inc.

About The Position

The Information Security Risk and Compliance Senior Analyst leads and supports Wawa’s information security risk management and compliance activities to help protect information assets and associated systems. The role independently manages key parts of the technology risk management process, including the Information Security Risk Register, risk acceptance requests, risk reporting, security control assessments, and tracking risk treatment and remediation. It communicates risk conclusions and decisions needed to technology, business, and leadership stakeholders. The position is heavily involved in Wawa’s PCI DSS compliance program, including scoping, evidence collection, control validation, assessor support, and remediation tracking. Depending on experience, the Senior Analyst may lead portions of the annual PCI assessment. The role also supports information security program activities, audits, incident response, security architecture and technology projects, and cross-department remediation work. It serves as a technical security consultant to internal business teams and IT, and may lead medium-sized internal security technology and remediation projects.

Requirements

At least 5 years of experience in a combination of incident response, information security, and IT.
Demonstrated experience independently conducting technology or cybersecurity risk assessments and communicating conclusions to technical and nontechnical stakeholders, including leadership.
Experience maintaining risk registers, evaluating risk acceptance requests, assessing controls, determining residual risk, and tracking risk treatment or remediation commitments.
Professional information security certification, such as CISSP, CEH, GISP, or a similar credential.
Advanced knowledge of information security management frameworks such as NIST 800-53, the NIST Cybersecurity Framework, ISO/IEC 27001, or Critical Security Controls.
Moderate knowledge of information security concepts and technologies, including networking, network segmentation, vulnerability scanners, firewalls, IPS/IDS, network analyzers, data loss prevention, security event management, encryption, proxies, cloud services, and mobile devices.
Ability to work independently and collaboratively, communicate effectively, think critically, solve problems, manage projects under strict timelines, and perform in a demanding, dynamic environment.
Ability to lead medium-sized internal security technology and remediation projects with limited dependencies on external IT teams.
High personal integrity and the ability to handle confidential matters professionally with sound judgment and maturity.
Initiative, dependability, resilience to change, and ability to work with little supervision.

Nice To Haves

Experience supporting PCI DSS assessments, including scoping, evidence collection, control validation, or remediation.
PCI ISA, PCIP, or comparable hands-on PCI assessment experience.
A degree in a technology-related field; equivalent work- or education-related experience is also accepted.

Responsibilities

Maintain the Information Security Risk Register, ensuring risks are documented, assigned to accountable owners, supported by treatment plans, and tracked through closure or formal acceptance.
Lead technology and information security risk assessments for new initiatives, material changes, existing services, and identified control gaps.
Evaluate and document risk scenarios, assets, threats, control weaknesses, likelihood, business impact, and residual risk using Wawa’s approved methodology.
Review risk acceptance requests for completeness, evidence quality, ownership, and alignment with risk management requirements; communicate recommendations and decisions needed to leadership.
Develop and deliver risk reporting for technology, business, and leadership stakeholders, covering exposure, trends, aging, ownership, remediation status, and required decisions.
Monitor risks, exceptions, and remediation commitments; challenge insufficient treatment plans and escalate overdue or materially changing risks.
Assist with the information security program, including PCI compliance, NIST maturity, and ongoing program development.
Assist with cross-department remediation workstreams and lead IT-focused remediation projects.
Develop and update information security policies and standards.
Execute applicable information security management framework controls.
Identify and document technology-related vendor risk and compliance.
Provide technical expertise related to security and vulnerability assessment tools; assist with ad hoc vulnerability compliance reporting and follow up to ensure vulnerabilities are addressed.
Support the Information Security Incident Response team during cyber incidents.
Assist in developing metrics to measure the effectiveness of the risk and compliance program.
Validate that information security requirements are incorporated into architectures and new technology projects.
Maintain internal relationships between Information Security and IT, engaging directly with peers as appropriate.
Maintain external industry relationships with peers, vendors, and other relevant parties to address trends, findings, threats, and cybersecurity risks.
Act as a technical information security consultant for internal business teams and IT in implementing and supporting technologies.
Assist in the technical deployment of security solutions that enhance Wawa’s information security architecture.
Maintain foundational PCI DSS knowledge, stay informed of changes to the standard, evaluate new systems for impact, and support the annual PCI audit.
Support IT audits and assessments, including the annual PCI audit, IT general controls review, and other security and general IT control assessments.
Provide technical assistance for technical security services.
Provide information security assistance and guidance for IT and business projects involving areas such as cloud services, mobile technology, data analytics, AI, bots, and IoT.
Be available for a 24x7x365 on-call rotation to review emergency changes and support information security incidents.
Lead, mentor, and influence others.