Sr. Analyst, Governance, Risk, And Compliance

Salary Range $100,000 - $130,000*
Job Description:
Who We Are:
Saks Cloud Services (SCS) is an operating company within Saks, the premier digital platform for luxury fashion. SCS provides IT infrastructure services, technology consulting and systems integration services, while also serving as a software reseller and service provider.
Role Summary:
SCS is looking for an Information Security GRC Senior Associate to be a key member of the SCS Information Security organization. We seek a dynamic Information Security GRC Senior Associate that enjoys working on security challenges in a collaborative fashion. This person will be responsible for establishing an Information Security governance framework, implementing security compliance programs with a strong focus on IT Sarbanes Oxley and Payment Card Industry (PCI-DSS) compliance and the protection of sensitive data including the Personal Identifiable Information of employees and customers.
Role Description:

• Responsible for creating and rolling out Information Security policies and standards. Responsible for aligning security requirements with business objectives and understanding applicable alignment with security and risk compliance frameworks. Support and manage the enterprise information security controls framework as well as work with global stakeholders on corresponding policies, procedures, and standards.
• Be a critical member of the IT SOX and technology internal controls program
• Lead the Payment Card Industry (PCI-DSS) compliance program, including technical controls implementation, gap identification, and liaising with PCI QSA auditors. Serve as a cross-functional project lead in support of PCI compliance objectives and ensures internal teams are prepared for assessments, deliverables, and due dates needed to meet annual compliance requirements.
• Understand Data Privacy regulations - e.g., PII - Personal Identifiable Information, and implement solutions to meet those regulations. Develop necessary capabilities, standards, and services, in partnership with Marketing, Product, and Technology departments, to protect sensitive information effectively.
• Engages with business units to identify risks and track the implementation of risk mitigation plans. Assesses risk management tools, techniques, and procedures to enhance risk management capabilities throughout the enterprise.
• Supports the development of metrics for the Information Security risk management reporting dashboard including the status of the security governance, risk remediation, and audit compliance efforts
• Assist in the implementation of governance and risk management solutions to automate processes and workflows.
• Represent the information security program during contract negotiations. Participate in and support Third-Party Risk Assessment activities of prospective and existing vendors.
• Provide input and direction into the development and maintenance of the Disaster Recovery and Business Continuity Plans

Key Qualifications:

• Expertise in Information Security Governance Risk and Compliance is required.
• Expertise in IT SOX, ITGC, Technology Risk, Internal Controls
• Expertise in Payment Card Industry - Data Security Standard (PCI-DSS) required.
• Experience with information security controls frameworks (NIST 800-53, ISO27001, PCI-DSS).
• Data privacy and protection experience is highly preferred (GDPR, CCPA/CPRA).
• Experience executing information security risk assessment methodologies and familiarization.
• Experienced in assessing security risks in modern cloud Software as a Service (SaaS), Platform as a Service (SaaS), and Infrastructure as a Service (IaaS) technologies.
• Experienced with evaluating and validating controls around the full technology stack from application, operating system, database, and networking layers.
• Expertise in technical and business environment, familiarity with security standards, experience with business continuity, disaster recovery, auditing, risk management, vulnerability assessments, and cyber-security and incident management.
• Ability to work closely with people at all levels of the organization and facilitate the implementation of corrective action as needed.
• Ability to analyze, communicate, articulate risk, governance, and Compliance trends and program requirements.
• Excellent written and verbal communications, critical thinking skills, effective interpersonal skills, strong formal presentation abilities.
• Minimum of 4 years experience in Information Security Governance Risk and Compliance role, preferably in the retail sector.
• Certification of either CISSP or CISM is preferred.
• Bachelor or Masters in Computer Science, Information/Cyber security, and/or Information Systems.
• Legal right to work in the United States.

Your Life and Career at SCS:

• Be a part of an entrepreneurial team hyper focused on massive growth
• Convenient and collaborative modern offices in Lower Manhattan with onsite perks
• Benefits package for all eligible full-time employees (including medical, vision and dental)
• An amazing employee discount

Thank you for your interest with Saks. We look forward to reviewing your application.
Saks provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Saks complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.
Saks welcomes all applicants for this position. Should you be individually selected to participate in an assessment or selection process, accommodations are available upon request in relation to the materials or processes to be used.
Saks.com is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.
*The above expected salary range may have some variability based upon factors including, but not limited to, a candidate's overall experience, qualifications, and geographic location. If you are interested in the role, we encourage you to apply and, if selected to move forward in the interview process, you will have a chance to speak with our recruitment team regarding your specific salary expectations.