Information Security Risk Analyst in Warrington

OVERVIEW:

KPMG Jamaica has a delivery center named "KPMG Jamaica Extended Support Services (KJESS)" operating from Kingston, which is contracted to provide support to its member firm KPMG United States ("the Client").

JOB SUMMARY:

In this role, you will liaise with IT and other business representatives to ensure project pipelines are understood and reflected in IT Risk & Security's resource planning. You will participate in skills development activities for information security personnel, continuously improve security aspects of operating processes, and perform information security risk assessments of technology-enabled projects on a periodic schedule.

JOB RESPONSIBILITIES: Service Delivery

• Perform information security risk assessments of technology-enabled projects with standard levels of complexity against applicable industry-standard or firm-specific control frameworks
• Conduct vendor reviews, define security requirements, facilitate security testing and support the management of residual risk as part of the assessment process
• Apply knowledge of application architecture, design, development, secure coding principles and emerging standards to identify security findings and clearly communicate associated risks and potential remediation
• Advise and assist project teams in identifying compensating-control alternatives where established security requirements cannot be met
• Serve as a primary point of contact between IT project teams and IT Security groups to help coordinate appropriate security resources and support security-related project objectives and timelines
• Review evidence submitted to close corrective-action plans and assess whether the evidence meets applicable control objectives
• Liaise with IT and business representatives to understand project pipelines and support IT Risk & Security resource planning
• Support skills-development activities for information security personnel related to security best practices
• Contribute to the continuous improvement of security practices and operating processes

EDUCATION/EXPERIENCE:

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field
• Minimum of three (3) years of relevant experience with recent experience in information security assessment or compliance
• Working knowledge of security principles, IT security controls and related technologies and products
• Familiarity with relevant security and control frameworks, including NIST 800-53, NIST 800-171, NIST 800-66, CMMC, NIST Framework, ISO, HITRUST and/or PCI
• CISSP or CISA certification preferred
• Solid verbal/written communication, problem-solving, analytical, and independent judgement skills to support an environment driven by customer service and teamwork
• Strong problem-solving skills, project management skills, and attention to detail
• Ability to work independently and collaboratively, manage multiple priorities, maintain strong documentation, and deliver high-quality work within deadlines in a changing environment
• Strong organizational and time management skills; ability to adhere to deadlines
• Proficiency with Microsoft 365 applications, including Word, Excel, PowerPoint, Outlook, Teams and SharePoint

COMPETENCIES:

Business Competencies

• Communication – Deliver clear, effective communication and take responsibility for understanding others
• Customer Service - Demonstrate a commitment to public service, serving internal and external customers while holding oneself accountable for quality outcomes
• Collaboration & Teamwork - Work cooperatively with others, inside and outside the organization, to accomplish objectives. Build and maintain mutually beneficial partnerships while leveraging information and achieving results
• Stakeholder Management - Build strong professional relationships while influencing others at all levels across the organization
• Drive Quality – Develops and monitors processes and organizes resources to achieve desired results
• Information Systems Administration - Understands and demonstrates knowledge of applicable information systems including concepts, principles, and practices related to their use and application
• Problem Solving – Identifies problems and uses logic, judgement, and data to evaluate alternatives and recommend solutions to achieve the desired organizational goal or outcome
• Risk Management - Plans and implements measures that will avoid, overcome or compensate for elements of risk

SPECIAL CONDITIONS:

• JESS uses a hybrid work model, allowing staff to work from home in Jamaica or in the office. Employees must be in the office at least five days per month, with more days possible if required by business needs.
• You are expected to use KPMG-approved Generative AI tools to support your daily work tasks.
• Expected to work in a fast-paced team environment.
• Will be working primarily in a paperless environment and expected to be using information systems for the entire workday to access data or perform activities.
• May be required to work extended hours periodically or on public holidays.
• Minimum of three (3) years of relevant experience with recent experience in information security assessment or compliance

Minimum of three (3) years of relevant experience with recent experience in information security assessment or compliance

#J-18808-Ljbffr