Security Consulting Program Manager

Description:

As a Security Consulting Program Manager within EY’s internal Security Consulting and Assurance team, this individual will be responsible for designing security architecture to address business requirements. This will include all aspects of information security applicable to EY’s internal and client facing technology solutions. This role leads and advises teams who deliver complex programs or solutions that address EY business requirements at the global, area, or industry sector levels. The role will include the performance of the following tasks: defining and designing the security architecture of new and existing systems; performing top/down risk assessment activities related to deployments, upgrades,

configuration upgrades, and analysis of technologies introduced for supporting technical operations.

The Program Manager will act as an intermediary between the business and the technical community to understand business requirements, define the security architecture, and support development and engineering teams with end-to-end management. As a trusted advisor, this individual will function within the program’s technology team to continually promote security-by-default design and facilitate delivery of information security services throughout the system development life cycle (SDLC). The Security Consulting Program Manager will direct technology teams in the implementation of appropriate risk treatment and mitigation options to address security vulnerabilities and is responsible for the translation of vulnerabilities into business risk terminology for communication to product owners and business leadership stake holders.

Essential Functions Of The Job

Application architecture and application security principles and practices is a must. 
Define security architectures and provide pragmatic security guidance that balance business benefit and risks. 
Engage technology teams in order to evaluate and prescribe security controls at all touchpoints throughout the technology architecture 
Define security configuration standards for platforms and technologies 
Provide knowledge sharing and technical assistance to other team members 
Act as Subject Matter Expert (SME) in responsible technologies and have deep technical understanding of responsible portfolios 
Perform risk assessments of information systems and infrastructure 
Maintain and enhance the Information Security risk assessment methodology 
Develop appropriate risk treatment and mitigation options to address security risks identified during security review or audit 
Translate technical vulnerabilities into business risk terminology for business units and recommend corrective actions to customers and project stake-holders 

Knowledge And Skills Requirements

Cloud technologies (MS Azure specifically) 
Strategic skills to drive secure technology architectures and software solutions, identify security risks and prescribe mitigating security measures in accordance with the firm’s risk tolerance level. 
Five or more years working experience with the architecture, design and engineering of web-based multi-tier information systems or network infrastructures 
Experience with security architecture, design and assessment of accounting and auditing systems. 
Ability to appropriately balance firm security needs with business impact & benefit
Ability to facilitate compromise to incrementally advance security strategy and objectives
An overall understanding of the business objectives of EY with an ability to build relationships with business partners and across EY IT 
Ability to team well with others to facilitate and enhance the understanding & compliance to security policies 
Experience facilitating meetings with multiple customers and technical staff, including building consensus and mediating compromise 
High degree of tolerance for ambiguity 
Experience conducting risk assessments, vulnerability assessments, vendor and third-party risk assessments and recommending risk remediation strategies 
Experience working with common security tools and methods to identify security exposures and business risks 
Experience working with common information security standards, such as: ISO 27001/27002, 
NIST, PCI DSS, ITIL, COBIT 

Job Requirements

Education
An advanced degree in Computer Science or a related discipline, or equivalent work experience 
Required Experience
Eight (8) or more years of experience in security architecture, application security, networking, data center configuration, cloud technology, Prior experience managing Information Security programs
Five (5) years or more experience in an Information Security or Information Technology discipline
Experience in MS Azure Cloud and security related configurations and options
Experience working with complex projects with global deployments
Familiarity with information system attack methods and vulnerabilities
Excellent ability to analyze and translate business cases, product roadmaps and program goals into information security strategies 
Experience in the Agile development lifecycle 
Experience in managing the communication of security findings and recommendations to IT project teams and product owners 
Exceptional judgment, tact, and decision-making ability 
Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change Outstanding time and tasks management, interpersonal, communication, organizational, and decision-making skills 
Strong English language skills are required 
Desired Experience
Experience with other cloud technology solutions, Amazon AWS, etc.
Experience in technologies such as block chain, RPA, AI, etc.
Knowledge of third-party risk assessments, IT security tools, incident response operations, data privacy, etc.