Job Summary:

The Alshaya group IS Security Governance, Risk, and Compliance (GRC) Officer develop and maintain information security policies and workforce training and awareness. 

The GRC officer serves as a critical resource for staff and leaders regarding information security policy implementation, interpretation, and compliance. 

The GRC officer assesses and prioritizes information security and cybersecurity risk across the organization, facilitates compliance with regulatory requirements and information security policies, and develops and reports on information security metrics.

The GRC Analyst is responsible for reducing information security and cybersecurity risk to UW Health by helping to prioritize and drive remediation efforts throughout the organization through the following:

• Establishing and maintaining governance and compliance standards.

• Conducting risk assessments to identify vulnerabilities internally and within vendor or third-party supplier products.

• Creating, maintaining, communicating, and enforcing information security policies.

• Advising senior leadership on risk management strategies, including risk mitigation, risk reduction, risk transfer, the risk exception process and residual risk analysis 

MAJOR RESPONSIBILITIES 

Governance and Compliance:

• Develops and implements a data security risk reporting framework, aligned with ISO, for management teams and governance committees.

• Designs and documents technical, administrative, and physical controls to ensure the business demonstrates compliance, ensuring that Alshaya meets both the requirements and intent of its regulatory and compliance obligations.

• Facilitates the remediation of control gaps and escalates critical issues to leadership.

• Manages an exception review and approval process, and assures exceptions are documented and periodically reviewed.

• Prepares for and facilitates examinations by qualified security assessors for regulations such as PCI DSS. Works closely with control owners and internal and external auditors to ensure requests are completed timely.

• Assists with the evaluation of the effectiveness of the information security program by developing, monitoring, gathering, and analysing information security and compliance metrics for management. 

Information Security Risk Assessment:

• Identifies, analyses, evaluates, and documents information security risks and controls based on established risk criteria.

• Conducts security risk assessments of planned and installed information systems to identify vulnerabilities and risks.

• Recommends controls to mitigate security risks identified via risk assessment process.

• Communicates risk findings and recommendations that are clear and actionable by business stakeholders. 

Security Policy Management and Workforce Training and Awareness:

• Supports workforce security activities including culture, awareness, and training.

• Facilitates eDiscovery and collection of data to support investigations of possible security or policy violations. Analyses information security incidents in collaboration with other stakeholders. Coordinates remediation and awareness training.

• Researches, recommends, and contributes to information security polices, standards, and procedures. Assists with the lifecycle management of information security policies and supporting documents.

• Works with other organizational participants to implement information security