It Compliance Specialist

The IT Compliance Specialist at Norfolk Southern supports the development and implementation of compliance programs, policies, reporting, and practices. We are looking for an experienced professional that will work with the team to ensure that our IT operations comply with legal regulatory standards, procedures, and policies. Your duties will include working with various  departments to comply with internal and external audits, identify gaps in Information Security policies and work with the Security Architecture team to fulfill them, work on data privacy activities and training, work with the Security Awareness team to develop and deliver effective compliance training, among other functions.

To be successful as an IT Compliance Specialist, you should be able to identify compliance issues and recommend solutions. You should also have strong analytical thinking skills and be able to maintain meticulous records of compliance activities.

Principal Duties
    Provide support to IT departments with internal and external audit requests.
    Track and coordinate IT teams' responses to IT Audits.
    Provide support on SOX related and other assessments (internal and with external auditors) to ensure that controls are functioning effectively and are adequate.
    Provide support during reviews of security policies, procedures, standards
    Consult with the legal department as needed on compliance matters.
    Work with the Security Awareness team in developing and providing employee training on compliance, policies, and best practices.
    Maintain records of compliance activities.
    Work with inter disciplinary teams as needed.
    Provide support in creating reports and metrics of compliance activities.

    Strong self-motivation, self-management, and time management skills, with the ability to work under pressure, prioritize work, meet targets, and intensify when appropriate while staying professional and positive.
    Strong analytical and critical thinking skills.
    Excellent listening, communication (written and verbal) and interpersonal skills with the ability to communicate with all levels within the organization, including both technical and non-technical personnel.
    Knowledge of US compliance regulations and requirements such as PCI, SOX, as well as various data security and privacy frameworks (NIST CSF, NIST SP800-53)
    Proven ability to lead with innovative ideas and an "out-of-the-box" thinker with the passion to learn and adapt
    Understanding of core IT general control processes (e.g., Change Management, System Development Lifecycle, Information Security, IT Operations etc.)
    Understand and use of basic project management methodologies, including the ability to plan, manage and maintain a complex, organization wide program over the longer term
    Excellent relationship-building skills 
    Documenting and reporting skills.
    Attention to detail.

Job Related Experience:
Preferred Level: 4+ years of compliance, audit, or relevant work experience in one or more of the following fields: information security, risk management, IT operations or another related field

Education:
Preferred Level: Bachelor's Degree (BS)
Preferred Majors: computer science, information technology or management information systems, business administration with an emphasis in accounting or technology.

Licenses / Certifications:
    CRCMP, CISA, CISM or other industry certifications will be considered a plus
    Knowledge of security standards: NIST Cyber Security Framework, NIST SP800-53, COBIT, SOX