Job details
Job type full-time
Full job description
Our information technology security group is seeking a senior information security policy analyst to join our growing team in our remote work arrangement.
Position summary:
The senior information security policy analyst will lead the development and management of information security policies, control standards and guidelinesThe senior information security policy analyst will collaborate within the information security team and across partner business units to evaluate the business risk environment, assess key control appropriateness and effectiveness, determine information security risk, and provide direction on the development of appropriate security measures to mitigate risk exposure.
In addition, the senior information security policy analyst must be a strong communicator and relationship builder, who uses broad skills will track remediation of any identified control gaps and deficiencies, analyze data for management reporting and ensure all cyber and data security requirements are in place.
This is a full-time, exempt role.
In this role, you will:
Mature, execute and maintain a policy management lifecycle process, including develop, implement and manage communication of security policies, control standards, control procedures, best practices, guidance and controls.
Provide support for security governance activities, including managing communication about security control frameworks, policies and standards.
Continuously assess existing policies for relevancy and accuracy and partner with the business to identify and manage risks associated with policy violations and exceptions
Develop reporting for management by analyzing it security controls and risk exposure.
Identify, assess, track and report on security risks across the enterpriseTrack risk decisions and remediation plans and communicate risks to both technical and non-technical audiences.
Execute against continuous monitoring and continuous assurance activities including monitoring for changes to the system, performing periodic assessments of security controls, tracking control remediation actions, updating system security documentation, reporting status of security activities and facilitating ongoing risk determination and acceptance.
Responsible for ensuring that all applicable regulatory requirements are addressed, and security controls are managed and maintained.
Participate in it initiatives, as necessary, to ensure security control measures are addressed and imbedded in business-as-usual activities prior to project completion.
Understand the security risk landscape and proactively identify the need for changes to existing controls to meet and exceed industry standards.
Responsible for building and operating our security risk management processes: risk assessment design and execution, risk treatment, issue and action management portfolio oversight, insight analysis, and reporting
Advise and collaborate with smes, including audit & compliance, teams to ensure design and testing of security controls are aligned with leading best practices and executed effectively to manage risk
What you need to apply:
A bachelor`s degree in computer science or technology/information security-related field.
Ten (10+) years’ direct experience in an information security role where risk-based methodology is used.
Expert knowledge of information security systems and procedures, strong analytical and problem-solving skills, excellent communication skills, expertise in computer networks.
Ability to think strategically about security risks and tie those to tactical organizational activities and goals.
An interest in continued professional development.
Familiarity with fair methodology
Professional security management certification is desirable, such as certified information systems security professional (cissp), certified information security manager (cism), certified information systems auditor (cisa) or other similar credentials.
Deep knowledge of nist security management frameworks including 800-53 and cybersecurity framework is preferred.
Able to work independently and act as coach to other team members as necessary.
Experience leading through influence
Communication experience, interpersonal experience, and experience working cross-functionally with various teams
Career development:
It’s not just a job, it’s a career, and we are here to support you every step of the wayWe want you to be successful and fulfilledThrough on-the-job experiences, personalized coaching and our robust learning and development programs, we encourage you – at every level – to grow and develop.
Benefits:
We offer comprehensive benefits to help you be healthy, build financial security, and balance work and home lifeAt the hanover, you’ll enjoy what you do and have the support you need to succeed.
Benefits include:
Medical, dental, vision, life, and disability insurance
401k with a company match
Tuition reimbursement
Pto
9 company holidays
Flexible work arrangements
On-site medical/wellness center (worcester only)
Eeo statement:
“the hanover values diversity in the workplace and among our customersThe company provides equal opportunity for employment and promotion to all qualified employees and applicants on the basis of experience, training, education, and ability to do the available work without regard to race, religion, color, age, sex/gender, sexual orientation, national origin, gender identity, disability, marital status, veteran status, genetic information, ancestry or any other status protected by law.
Furthermore, the hanover insurance group is committed to providing an equal opportunity workplace that is free of discrimination and harassment based on national origin, race, color, religion, gender, ancestry, age, sexual orientation, gender identity, disability, marital status, veteran status, genetic information or any other status protected by law.”
As an equal opportunity employer, hanover does not discriminate against qualified individuals with disabilitiesIf you require a reasonable accommodation, as a candidate for employment, please inform the hanover talent acquisition office.
Privacy policy:
To view our privacy policy and online privacy statement, click here.
Applicants who are california residents: to see the types of information we may collect from applicants and employees and how we use it, please click here.
