Director: Information Security Auditing

NTT Limited; Barcelona; Hybride; EUR 120 000 - 180 000; Plein temps

Résumé du poste

NTT DATA is seeking a Director of Information Security Governance, Risk and Compliance to lead policy development, risk assessment and compliance programs across the organisation. This role drives the ISMS strategy, engages senior stakeholders and ensures alignment with regulatory obligations.

The position is hybrid, demanding strategic thinking, strong leadership, and hands-on expertise in security controls, audits, and incident response to safeguard the company and its clients.

Qualifications

• Bachelor’s degree in Information Technology or Computer Science or related field.
• Security certifications such as CISA, CRISC, COBIT, IIA or equivalent preferred.
• Lead audit/Implementer - ISO 27001, SOC TSP preferred.

Responsabilités

• Oversees the development, evaluation and implementation of Information Security Policy, Standards, and Guidelines.
• Oversees information security risk assessments, TRA, TFA and policy compliance reviews and supports the development and operational effectiveness of IT security controls.
• Manages and monitors Group risk in the company preferred risk management solution, ensure that risk is assessed, allocated and assigned, managed, monitored, and treated appropriately.
• Develops, scopes and discusses security compliance review schedules, reviews risk registers, risk and policy exceptions and authorization and performs threat and risk assessments of new technologies and vendors.
• Documents improvement in service design and ensures that the required security plan is developed and reviewed.
• Reviews service level and business requirements to develop service methodologies and an information security policy, assessments and methodologies.
• Advises on the reporting requirements and ensures the overall implementation of the ISM policy in service operation.
• Assists with the design and operation of related compliance with both internal security policies and application laws and regulations.
• Ensures that appropriate security assessment have been carried out so that the ISMS security strategy is developed and aligned to service and operational requirements.
• Develops an ISMS security audit management strategy that is aligned to service and operational requirements and develop information security design criteria and templates.
• Considers technical requirements and implications of service and business levels and develop the ISMS security review criteria, verifying that the solution design meets ISMS, client, and regulatory requirements.
• Evaluates the adequacy, implementation, maintenance of operational processes, guides and drives the implementation of process controls to ensure alignment to ISMS obligations.
• When deviations occur, ensures root cause is identified and treated.
• Monitors and holds accountable managers to implement prevention and remediation to ensure ongoing compliance to ISM policy.

Connaissances

People management

Information security

Risk management

Policy development

Stakeholder communication

Strategic thinking

Project management

Formation

Bachelor’s degree in Information Technology or Computer Science

CISA/CRISC/ COBIT/IIA or equivalent certifications

ISO 27001 Lead auditor/Implementer

SOC TSP certifications

Outils

ServiceNow GRC

Description du poste

Continue to make an impact with a company that is pushing the boundaries of what is possible. At NTT DATA, we are renowned for our technical excellence, leading innovations, and making a difference for our clients and society. Our workplace embraces diversity and inclusion - it’s a place where you can continue to grow, belong, and thrive. Your career here is about believing in yourself and seizing new opportunities and challenges. It’s about expanding your skills and expertise in your current role and preparing yourself for future advancements. That’s why we encourage you to take every opportunity to further your career within our great global team. Your day at NTT DATA The Director, Information Security Governance, Risk and Compliance is a leadership role that supports the company by way of protecting its brand, warranting compliance to its regulatory and contractual obligations.

Key responsibilities:

• Oversees the development, evaluation and implementation of Information Security Policy, Standards, and Guidelines.
• Oversees information security risk assessments, TRA, TFA and policy compliance reviews and supports the development and operational effectiveness of IT security controls.
• Manages and monitors Group risk in the company preferred risk management solution, ensure that risk is assessed, allocated and assigned, managed, monitored, and treated appropriately.
• Develops, scopes and discusses security compliance review schedules, reviews risk registers, risk and policy exceptions and authorization and performs threat and risk assessments of new technologies and vendors.
• Documents improvement in service design and ensures that the required security plan is developed and reviewed.
• Reviews service level and business requirements to develop service methodologies and an information security policy, assessments and methodologies.
• Advises on the reporting requirements and ensures the overall implementation of the ISM policy in service operation.
• Assists with the design and operation of related compliance with both internal security policies and application laws and regulations.
• Ensures that appropriate security assessment have been carried out so that the ISMS security strategy is developed and aligned to service and operational requirements.
• Develops an ISMS security audit management strategy that is aligned to service and operational requirements and develop information security design criteria and templates.
• Considers technical requirements and implications of service and business levels and develop the ISMS security review criteria, verifying that the solution design meets ISMS, client, and regulatory requirements.
• Evaluates the adequacy, implementation, maintenance of operational processes, guides and drives the implementation of process controls to ensure alignment to ISMS obligations.
• When deviations occur, ensures root cause is identified and treated.
• Monitors and holds accountable managers to implement prevention and remediation to ensure ongoing compliance to ISM policy.

To thrive in this role, you need to have:

• Relevant people management skills.
• Significant understanding of complex inter-relationships in an overall system or process.
• Excellent interpersonal and consultative skills with the ability to map business needs to technology solutions.
• Ability to discuss and report technology and information security risk with non-technology and executive business stakeholders.
• Ability to display analytical thinking and a proactive approach.
• Team player with the ability to display consistent client focus and orientation.
• Ability to develop, define and articulate ISM strategies.
• Excellent strategic thinking and decision-making abilities.
• Ability to plan and organize, with good project management skills.
• Significant understanding of security risk management, operational processes and controls - End-to-end information security risk lifecycle management.
• Significant knowledge of information security management and policies, risk management and risk frameworks.
• Maintains up-to-date knowledge of security threats, countermeasures, security tools, and network technologies.
• Significant knowledge of technological advances within the information security arena.

Academic qualifications and certifications:

• Bachelor’s degree or equivalent in Information Technology or Computer Science degree or related field.
• Security certifications such as CISA, CRISC, COBIT, IIA or equivalent preferred.
• Certifications such as Lead audit/Implementer - ISO 27001, SOC TSP preferred.

Required experience:

• Significant experience gained within the Technology Information Security Industry.
• Significant experience with Operational Risk Management and Enterprise Risk Management.
• Significant experience with Enterprise Risk Management solutions (i.e., ServiceNow GRC or similar).
• Significant experience in technical Information Security consulting, architecture, design, implementation.
• Significant experience managing and leading Information Security, Governance, Risk and Compliance teams preferably gained within a similar organizational environment.

Workplace type:

Hybrid Working

Equal Opportunity Employer NTT DATA is proud to be an Equal Opportunity Employer with a global culture that embraces diversity. We are committed to providing an environment free of unfair discrimination and harassment. We do not discriminate based on age, race, colour, gender, sexual orientation, religion, nationality, disability, pregnancy, marital status, veteran status, or any other protected category.

Accelerate your career with us. Your career here is about believing in yourself and taking on great opportunities and new challenges. It’s about growing your skills and expertise in your current role and preparing yourself for the future. That’s why we encourage you to take every opportunity to grow your career within our great global team.