Info Security Analyst II

Company: Ferguson Experienced
Location: Newport News
Posted on: February 13, 2020

Job Description:

Job Description: The IT GRC Analyst assists with and participates in the planning, design, implementation, operation, and maintenance of IT Governance, Risk & Compliance (GRC) efforts intended to support Business and IT Risk Management and Assurance goals and objectives. Primary functions include: the collection of appropriate and relevant data for the monitoring and analysis of specific IT control activities, liaising with and providing consultative support to IT control owners and performers, generation of reports for analysis, assessment and presentation to IT and business management, recommendations on and tracking of control remediation, and coordination of efforts with internal and external auditors. This position works directly with IT, HQ, Management, Group staff and Operating Companies, Small Businesses and Subsidiaries, and with external business partners to achieve the necessary business goals. JOB DUTIES & RESPONSIBILITIES: - Analyze and recommend operational and business workflow changes to management in order to strengthen the control environment/security posture. - Participates in IT GRC team efforts to plan, design, implement and maintain IT Governance, Risk & Compliance initiatives and their supporting elements. - Scoping of relevant business entities, systems, & processes - Identification of and coordination with Risk & Control Owners on all relevant requirements - Consultation and assistance to Risk & Control Owners in the planning, design, implementation, operation, maintenance & remediation of control activities and other supporting requirements (e.g. policies, standards, processes, system configurations, etc.) as appropriate. - Development of appropriate technical job aids and automation (e.g. scripts, queries, dashboards, etc.) in support of control performance, monitoring and assessment. - Alignment and coordination with Financial Controls, Internal Audit teams as appropriate - Coordination with and support of External Audit partners in the planning, execution of, and reporting on annual external testing of Internal (IT General) Controls over Financial Reporting. - Coordination, tracking and reporting of remediation plans and progress for all identified IT Control deficiencies - Enables the performance of specific IT control activities in support of business objectives. - Collection and distribution of appropriate and relevant data in a timely fashion for the performance of access reviews and other identified control activities - Identification and communication of deficiencies and other items of concern to appropriate parties during the performance of control activities for timely correction and/or remediation as needed - Maintenance and archiving of all relevant data and supporting documentation as evidence of the performance of control activities - Perform duties as requested by Management, in addition to the essential job functions described above. QUALIFICATION & REQUIREMENTS: - A minimum of four (4) years' experience in Information Security and/or Technology - Master's, Bachelor's or Associate Degree in Information Security, Information Technology or Information Technology Management - Certifications such as CISSP, CISM, CISA, CRISC, GSEC, or PCIP. - Knowledge of general concepts of IT Governance, Risk Management, and Compliance with corporate policies and legal, regulatory and contractual requirements - Knowledge of general concepts and requirements related to Sarbanes-Oxley risk management and control requirements. - Knowledge of general concepts and requirements regarding AICPA auditing standards, SSAE 18 audit engagements, and System and Organization Controls (SOC) reporting. - Knowledge of general concepts of internal controls, risk assessments and information security. - Knowledge of technical platforms, networks, security concepts, and data retrieval techniques. - Self-motivated, with the ability to initiate new work without immediate supervision. - Strong knowledge of auditing techniques and/or control environments. - Substantial ability to create, organize, and analyze complex logical processes. - Proven ability to troubleshoot and solve complex and indistinct problems. - Ability to communicate with all audiences in a clear and professional written format. - Ability to speak publicly, including large groups, with all levels of management. - The Company is an equal opportunity employer as well as a government contractor that shall abide by the requirements of 41 CFR 60-300.5(a), which prohibits discrimination against qualified protected Veterans and the requirements of 41 CFR 60-741.5(A), which prohibits discrimination against qualified individuals on the basis of disability.

Keywords: Ferguson Experienced, Newport News , Info Security Analyst II, Professions , Newport News, Virginia