Security Consultant - EY Global Delivery Services

InfoSec Security Consultant

Job summary

• As a Security Consultant within EY’s internal Security Consulting and Assurance team, the individual will
• be a trusted advisor to EY’s Audit Technologies portfolio. Overarching responsibilities will include: direct
• engagement in delivery on programs and projects, defining security architectures, providing security
• guidance, identifying and prioritizing security-related requirements, promoting secure-by-default
• designs and facilitating delivery of information security services throughout the system development life
• cycle (SDLC). The role will also direct technology teams in the implementation of appropriate risk
• treatment and mitigation options to address security vulnerabilities. Security Consultants are
• responsible for the translation of vulnerabilities into business risk terminology for communication to
• business stake holders.
• Essential functions of the job

• Define security architectures and provide pragmatic security guidance that balance business

benefit and risks.

• Engage technology teams in order to evaluate and prescribe security controls at all

touchpoints throughout the technology architecture

• Define security configuration standards for platforms and technologies
• Provide knowledge sharing and technical assistance to other team members
• Act as Subject Matter Expert (SME) in responsible technologies and have deep technical

understanding of responsible portfolios

• Perform risk assessments of information systems and infrastructure
• Maintain and enhance the Information Security risk assessment methodology
• Develop appropriate risk treatment and mitigation options to address security risks identified

during security review or audit

• Translate technical vulnerabilities into business risk terminology for business units and

recommend corrective actions to customers and project stake-holders

Knowledge and skills requirements

• Cloud technologies (MS Azure specifically)
• Strategic skills to analyze technology architectures and software solutions, identify security risk

and prescribe mitigating security measures in accordance with the firm’s risk tolerance level.

• Five or more years working experience with the architecture, design and engineering of web-

based multi-tier information systems or network infrastructures

• Experience with security architecture, design and assessment of accounting and auditing

systems.

• Ability to appropriately balance firm security needs with business impact & benefit
• Ability to facilitate compromise to incrementally advance security strategy and objectives
• An overall understanding of the business objectives of EY with an ability to build relationships

with business partners and across EY IT

• Ability to team well with others to facilitate and enhance the understanding & compliance to

security policies

• Experience facilitating meetings with multiple customers and technical staff, including building

consensus and mediating compromise

• High degree of tolerance for ambiguity
• Experience conducting risk assessments, vulnerability assessments, vendor and third party risk

assessments and recommending risk remediation strategies

• Experience working with common information security standards, such as: ISO 27001/27002,

NIST, PCI DSS, ITIL, COBIT

Job Requirements

Education

An advanced degree in Computer Science or a related discipline, or equivalent work experience

Required Experience

• Five or more years of experience in security architecture, application security, networking, data

center configuration, cloud technology, and the management of a significant Information

Security risk functions

• 5 or more years of experience in an Information Security or Information Technology discipline
• Experience in the Agile development lifecycle
• Experience in managing the communication of security findings and recommendations to IT

project teams and management

• Exceptional judgment, tact, and decision-making ability
• Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change
• Outstanding management, interpersonal, communication, organizational, and decision-making

skills

• Strong English language skills are required

Desired Experience

• Experience with cloud technology solutions, particularly MS Cloud
• Experience in technologies such as block chain, RPA, AI, etc.
• Knowledge of the Scaled Agile Framework

• Certification requirements
• It is preferred that candidates hold or be actively pursuing related professional certifications within
• the GIAC family of certifications or CISSP, CISM or CISA