CISS Risk Analyst

Required Skills

• The job is to assess the controls at our suppliers to ensure that they are adequate to mitigate the risk of outsourcing to that supplier.

• This assessment would be accomplished by interpreting independent reviews of the supplier, minimal on-site reviews and testing at the supplier, as well as utilizing the available tools (MS Office, Archer, Hiperos, etc.), to automate and communicate the scoring of inherent and residual risks involved in supplier relationships.

• Information Security experience (preferably Third Party Risk Management and Compliance)

• Familiarity with SOC 1 (SSAE 16*) and SOC 2 (**AT101) reports

• Ability to write process, procedures, flowcharts • Knowledge of regulatory and industry standards such GLBA, HIPAA, COBIT, FFIEC

Information Security experience (preferably Third Party Risk Management and Compliance)

• Familiarity with SOC 1 (SSAE 16*) and SOC 2 (**AT101) reports

• Ability to write process, procedures, flowcharts

• Knowledge of regulatory and industry standards such GLBA, HIPAA, COBIT, FFIEC

Preferred Skills and competencies

• IT Audit Experience

• Knowledge of FS-ISAC Shared Assessments, Pen Test results , PCI DSS

• Experience performing on-site third party reviews • CISA, CISSP, CRISC or other security certifications

• Archer (eGRC) or Hiperos (Supplier Management) experience

• Knowledge of Visual Basic and Macro Coding for MS Office applications