Risk Analyst

The Compliance Assessor of IT Risk & Compliance Management performs Security Risk Assessments on DIRECTV’s 3rd party vendors. 

An assesment would typically involve the following tasks:

• Communicating and interviewing vendors and internal business groups

• Obtaining and reviewing supporting documentation

• Performing on-site assessments (where necessary)

• Documenting vendor’s data security controls

• Summarizing the adequacy of security controls

• Outlining gaps & remediation steps

• Providing recommendations

• Capturing assessment results in centralized repository

Other responsibilities include:

• Assisting in the upkeep of governance, risk and compliance (GRC) software applications

• Interacting with team members and department/division personnel on other GRC related tasks

• Documenting data and process flows (e.g. data flow diagrams / swim-lane diagrams)

• Cataloging, tracking and reporting the status of other risk assessments and resolution actions

• Managing several GRC related tasks simultaneously without a great deal of direction or oversight

• Evaluating internal compliance to regulations such PCI

• Proposing practical risk mitigations based on cost, benefit and risk

• Should have minimum 1-2 years of experience working with IT compliance and/or security audits

• Should have experience with Governance, Risk & Compliance Programs

• Should have understanding of Payment Card Industry Data Security Standard (PCI DSS) and other compliance frameworks (e.g.: ISO 27001)

• Should have experience related to vendor management audits and/or SAS70/SSAE16 type audits

• Should be able to effectively communicate complex topics with both technical and non-technical personnel

• Should have experience in reviewing Polices & Procedures and security controls

• Big 4 consulting experience is considered an advantage

This opportunity is a Long Term Contract