Information Security Specialist Lead

Experian

1d•Remote

About The Position

Reporting to the Head of Information Security Policy and Standards, the Information Security Specialist Lead leads the identification, documentation, and implementation of the enterprise security risk and controls framework. The role helps ensure a sound security posture by designing and implementing risk-based security controls and contributing to best-practice cyber risk management in collaboration with business partners.

Requirements

Bachelor's degree in computer science, management information systems, or a relevant field, or equivalent demonstrable experience.
At least 5 years of hands-on controls experience, including security control design, implementation, and evaluation.
Experience with GRC tools such as Archer.
Understanding of industry best practices such as NIST, ISO, COBIT, CMMI, OWASP, and ITIL.
Detailed knowledge of governance, risk, and controls principles.
Knowledge of IT technologies and methods for securing them, including cloud security.
Knowledge of cybersecurity organizational practices, operations, risk management processes, principles, architectural requirements, engineering, threats, and vulnerabilities.
Industry certifications such as CCSP, CRISC, CISSP, or CISM, or equivalent experience.
Ability to understand and translate technical requirements for non-technical audiences.

Nice To Haves

Working knowledge of the AWS cloud environment.
Knowledge of the financial services industry and its regulations.
Experience using AI to automate processes.

Responsibilities

Lead the security risk and control modularisation strategy, engaging regional business units and central security and IT control owners to populate the controls library.
Maintain and update the integrated risk and control framework in accordance with information security policies, standards, industry practices, and regulations.
Review and provide expert challenge on control activities defined by first-line business units, ensuring alignment with control standard requirements and goals.
Identify, document, and report control activity gaps and recommend remediation.
Compile management reports, summary analyses, and detailed presentations about the risk and controls program.
Develop and present content for control implementation workshops with enterprise control owners.
Ensure information security controls are aligned and mapped to applicable risks in the Archer GRC platform.
Monitor internal and external risk indicators that could affect Experian and its mission, and provide them as inputs to control assurance and other EGSO activities.
Improve the efficiency of the risk and controls program by standardizing and automating processes, incorporating stakeholder feedback, and enhancing the engagement model.
Represent the Information Security Governance team on strategic projects and provide subject matter expertise in controls.