Sr.Analyst - IS Risk Management Assurance (L09)

Mployee.me; Pune District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Synchrony seeks a Sr.Analyst - IS Risk Management Assurance (L09) to support information security risk management across audits, assessments and control frameworks. You will ensure compliance with NIST, PCI-DSS, SOX 404, and related standards while coordinating with clients and internal teams.

Responsibilities include responding to client assessments, documenting findings, and driving process improvements within GRC and SRS tools.

Qualifications

• Bachelor’s Degree in Computer Engineering or related field with 2+ years in Information Security, or 4+ years without degree.
• Minimum 2 years of experience conducting security risk assessments.
• Good understanding of IS Risk Management Concepts.
• Good understanding of IT banking regulations & industry best practices (IT SOX 404, NIST, PCI DSS, HIPAA).
• Excellent interpersonal skills with ability to influence teams and external groups.
• Self-motivated and able to work independently or in a team; comfortable with virtual teams.
• Good understanding of foundational cloud security concepts.

Responsibilities

• Collaborate with the team and respond to client information security assessments.
• Engage with clients to discuss assessment findings, address questions, and provide guidance during client assessments.
• Document client assessment responses to support processes and commonly asked questions.
• Document and respond to SIG questionnaire for external client assessments.
• Familiarity with information security policies, procedures and standards to support client assessments.
• Review and action alerts from Security Rating Tools used to monitor Synchrony security posture.
• Support identification of process improvements and implementation of changes.
• Maintain clear communication with key stakeholders throughout the assessment process.
• Continuous improvements: obtain feedback to refine assessment methodologies.
• Perform RCSA against organization policies and regulatory frameworks.
• Gather evidence from InfoSec processes to document assurance of RCSA controls.
• Report any control violation findings through risk management framework.
• Support administrative tasks associated with GRC and SRS Tools (Black Kite).
• Evaluate and communicate security risks and solutions to business partners and IT management.

Skills

Security risk assessments

IS Risk Management Concepts

Interpersonal skills

Cloud security concepts

Education

Bachelor’s Degree in Computer Engineering or related field

Alternative: 4 years information security experience

Tools

SIG

UpGuard

Process Unity

Black Kite

Job description

Role Title: Sr.Analyst - IS Risk Management Assurance - Analyst (L09)

Synchrony (NYSE: SYF) is a leading consumer financing company that has been at the heart of American commerce and opportunity for nearly a century. Synchrony delivers credit and banking products that empower tens of millions of consumers to improve their financial lives and access what matters most. Leveraging innovative solutions that are shaping the future of retail commerce, Synchrony supports the growth and success of some of the nation’s most respected brands, alongside hundreds of thousands of small and midsize businesses, including health and wellness providers. Committed to excellence in service and culture, Synchrony is proud to be named as #3 as a Great Place to Work® in India and is honored to be ranked the #1 Best Company to Work For® in the U.S. by Fortune magazine and Great Place to Work®. For more information, visit www.synchrony.com.

Company Overview

Synchrony’s Information Security Risk Management program’s mission is to protect and enable Synchrony's business by integrating security risk management into our Technology landscape by proactively addressing emerging risk themes. Members of this group would have diversified exposure to Assessments and Audits (PCI, HIPAA etc.), Issue Management, Third Party Risk Management.

Organizational Overview

This role would be supporting information security assurance function part of information security risk management. The role will provide oversight to ensure that controls are adequate to meet legal, regulatory, policy, standards, and security requirements. The role will also participate in audits, reviews, and assessments to ensure compliance with multiple compliance and regulatory standards and frameworks including, but not limited to NIST, PCI-DSS, SOX 404, etc

Key Responsibilities

• Collaborate with the team and collectively respond client information security assessments
• Engage with clients to discuss assessment findings, address questions or concerns, and provide guidance and support during client assessment
• Document client assessment responses to support processes and commonly asked questions
• Document and respond to shared assessments SIG(Standardized Information Gathering) questionnaire for external client assessments
• Familiarity with Information security policies, procedures and standards to support client assessments
• Review and action alerts from Security Rating Tools used to monitor SYF security posture
• Support identification of process improvements and implementation of changes
• Maintain clear and open communication with key stakeholders throughout the assessment process, including client representatives and internal teams
• Continuous Improvements: Obtain feedback from clients and internal teams to identify areas for process improvement, refine assessment methodologies, and enhance the quality and value of future client assessments
• Perform RCSA (Risk & Control Self Assessments) against organization policies, standard controls and regulatory control frameworks
• Work collaboratively with all teams in InfoSec to gather evidence from their processes in support of documenting and validating the assurance of RCSA controls
• Report any control violation findings through organization risk management framework or model
• Support administrative and maintenance tasks associated with GRC and SRS Tools(Black kite)
• Evaluate and communicate security risks and solutions to business partners and IT management/staff
• Support risk management special projects for Ex:External Outbound data etc.

Required Skills/Knowledge

• Bachelor’s Degree in Computer Engineering or related field, with a minimum of 2 years of experience in Information Security OR in lieu of the Bachelor's degree, a minimum of 4 years of experience in Information Security.
• Minimum 2 years of experience conducting security risk assessments
• Good understanding of IS Risk Management Concepts
• Good understanding of IT related US Banking regulations & industry best practices (IT SOX 404, NIST, PCI DSS, HIPAA etc.)
• Excellent interpersonal skills with ability to influence team members, management & external groups
• Self-motivated & able to work independently or in a team environment & work with virtual teams
• Good understanding of foundational cloud security concepts

Desired Skills/Knowledge

• In depth understanding of Information Security and Risk Management foundational concepts
• Good understanding of data protection, Cloud and AI related concepts/technologies
• Experience third party risk assessment tools and technologies such as SIG, UpGuard, Process Unity etc.

Eligibility Criteria

• Bachelor's degree in Information Security, Computer Science, or a related filed with minimum of 2 years of practical experience in Information Security and in lieu of Bachelor’s Degree minimum of 4 years of relevant experience.

Work Timings:

5:00 AM to 2:00 PM EST

Job Family Group

Information Technology