Srmgr-information Security- Vendor Risk Management - Bethesda, United States - Marriott International, Inc

Marriott International, Inc

Verified Company

Bethesda, United States

3 weeks ago

Posted by:

Mark Lane

beBee recruiter

Description

Job Number

Job Category Information Technology

Location Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United States VIEW ON MAP

Schedule Full-Time

Located Remotely? Y

Relocation? N

Position Type Management

JOB SUMMARY
Excellent communication skills are required to effectively communicate (verbally and written) across all levels within the organization.

CANDIDATE PROFILE

Education and Experience

Required:

Bachelor's degree in Information Systems or related field or equivalent experience/certification
7+ years of information technology leadership experience including implementing, managing and governing security policies
3+ years direct work experience in thirdparty Risk Management
One or more current information security certifications such as Certified in Risk and Information Systems Controls (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)

Preferred:

A security certification such as GWAPT, GPEN, AWS Associate Architect, AWS Professional Architect, PCI experience.
Technical knowledge in one or more of the following areas is required: Application Security, Operating System security (UNIX, Windows, Mainframe, etc.) and network security (routers, switches, firewalls)
Technical leadership experience in an outsourced environment
Excellent communication skills and problemsolving ability
Experience conducting and maintaining vendor risk assessments
Experience with reviewing and assessing security controls of Cloud service providers
Proficient with assessing a multitiered system architecture (Web Server, App Server & Database)
Knowledge of OWASP Top 10 and SANS 2
Manual Web Application Testing experience.

CORE WORK ACTIVITIES

Security Risk & Compliance

Oversee, evaluate, and support the documentation, and validation processes necessary to assure that associates, information technology systems and business processes meet the organization's information assurance, security, and privacy requirements. Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations.
Document controls gap analysis and risk assessment of the thirdparty providers
Review controls exception requests and make riskbased approval decision
Lead, participate or perform various infrastructure compliance initiatives and projects
Perform Application Security Testing using (Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, Burp, or Retina)
Conduct and validate finding discovered during the scans
Monitor compliance to applicable security policies and standards and report related risk issues
Manage and administer processes and tools that enable the organization to identify, document, and track third party risks and compliance exceptions
Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures.
Oversee the information assurance (IA) program of an information system in or outside the network environment; may include procurement duties.

Maintaining Goals

Submits reports in a timely manner, ensuring delivery deadlines are met.
Promotes the documenting of project progress accurately.
Provides input and assistance to other teams regarding projects.

Managing Work, Projects, and Policies

Manages and implements work and projects as assigned.
Generates and provides accurate and timely results in the form of reports, presentations, etc.
Analyzes information and evaluates results to choose the best solution and solve problems.

- _Provides timely, accurate, and detailed status reports as requested._

Provides technical expertise and support to persons inside and outside of the department.
Demonstrates knowledge of jobrelevant issues, products, systems, and processes.
Demonstrates knowledge of functionspecific procedures.
Keeps uptodate technically and applies new knowledge to job.
Uses computers and computer systems (including hardware and software) to enter data and/ or process information.

Delivering on the Needs of Key Stakeholders

Understands and meets the needs of key stakeholders.
Develops specific goals and plans to prioritize, organize, and accomplish work.
Determines priorities, schedules, plans and necessary resources to ensure completion of any projects on schedule.
Collaborates with internal partners and stakeholders to support business/initiative strategies
Communicates concepts in a clear and persuasive manner that is easy to understand.
Generates and provides accurate and timely results in the form of reports, presentations, etc.
Demonstrates an understanding of business priori