Director, Information Security & Compliance

The Director of Information Security and Compliance provides strategic and operational leadership for Information Security and IT Risk Compliance efforts.

The role manages and coordinates core aspects of security administration, identity and access management, audit response, and vulnerability assessments within the boundaries of acceptable risk.

The director will conduct audits/assessments for IT Compliance, IT Security and Data Privacy.

New implementations and operational maintenance of existing business-critical applications will be examined.

The role extends to any part of the business that has risk associated with information assets.

The Director of Enterprise Security and Compliance reports directly to the Chief Information Officer.Qualifications:


* Bachelor's Degree in Business, Accounting, Information Technology, or other quantitative discipline.


* 10+ years of broad privacy and data protection, compliance or legal experience


* 5+ years of audit/assessment experience with PCI or SOX


* 3+ years leading a team of auditors or compliance analysts


* Sound understanding of security principles including logical access controls, change control, least privilege, segregation of duties, computer operations, network security, vulnerability management, and secure coding.


* Broad technical understanding of data management platforms (e.g., IBM DB2, Oracle, Microsoft SQL Server, etc.) and associated data security controls.


* Strong technology acumen and the ability to assess data privacy gaps in products/services design.


* Expert understanding of data classification, data protection, and data retention standards and practices.


* Familiarity with common enterprise and web application technologies.


* Experience with management and oversight of ERP security and role-based access management.


* Experience with project management best practices and collaborating with PMO.


* Experience with common information security management frameworks, such as International Organization for Standardization (ISO) 2700x, ITIL, CSC20, COBIT and National Institute of Standards and Technology (NIST) frameworks.


* Expert understanding of data protection regulations and standards (e.g., PCI, Safe Harbor, EU Data Protection Directive, etc.).


* Strong analytical and time management skills


* Ability to maintain a high degree of confidentiality

Preferred Requirements:


* Experience with Oracle's eBusiness Suite and Identity Management products


* Certified Information Security Auditor (CISA)


* PMI Project Management Professional (PMP)


* Payment Card Industry (PCI) Internal Security Assessor (ISA)


* Certified Information Privacy Professional (CIPP) or Certified Information Privacy Manager (CIPM)


* Industry Standard Security certifications including: SANS/GIAC GSNA, ISACA CISM, ISC2 CISSP, and ISC2 CSSLP.

Qualifications:


* Bachelor's Degree in Business, Accounting, Informati...