- Define, lead and deliver the information security and third-party risk assessment programmes.
- Delivery of the information security and third-party risk assessment programmes.
- Ownership of the information security and third-party risk assessment frameworks.
- Development and implementation of the information security and third-party risk assessment strategy.
- Definition of information security and third-party risk assessment services, deliverables and SLAs.
- Demand management and planning across information security and third party risk assessment services.
- Ensure integration of risk assessments with related processes and services
- information security and third-party risk assessment service measurement through SLAs, KRIs and KPIs.
- Accountable for leading information security and third party teams to conduct threat and asset-based risk assessments that identify and assess risks and identify key security controls required to manage risk within appetite.
- Establishment and delivery of a programme for periodic re-assessment of information security and third-party risks.
- Alignment with all relevant internal policies, standards and frameworks
- Population of Group Digital risk register.
- 5+ years’ experience in information security and third-party risk assessments.
- 3+ years in a senior management role.
- Risk definition including explanation of technical risks to non-technical audiences.
- Strong working knowledge of infrastructure, application, service (including cloud) and application security and mitigating controls.
- Senior stakeholder management.
- In depth understanding of security, risk and data privacy standards such as ISO 31000, ISO 27001, ISO 27701, IRAM, CIS, SOC 2, GDPR, ISO 27701, etc.
Job description provided by KPMG Global Services.
View the original posting
