Sr. Cyber Risk Analyst

Levi Strauss & Co.; Ciudad de México; Presencial; MXN 750.000 - 950.000; Jornada completa

Descripción de la vacante

Levi Strauss & Co. is seeking a Sr. Cyber Risk Analyst in Mexico City to lead risk assessments, govern the GRC program, and drive the policy lifecycle across the organization.

You will manage OneTrust, tier risks, and coordinate with regional teams to meet global compliance requirements. The role requires a strong background in ISO 27005, NIST CSF and CIS Top 18, plus hands-on experience with security controls, KRIs and PCI-DSS audits.

Formación

• BS or MS in Business, Computer Science, Information Security or related field.
• 3+ years in risk management, governance and cybersecurity requirements.
• Experience with PCI-DSS, HIPAA, SOX and ISO/NIST frameworks is preferred.
• Strong analytical, communication and collaboration abilities.

Responsabilidades

• Implement cyber risk strategy and manage the GRC program with OneTrust.
• Perform internal and third-party security risk assessments and document controls.
• Lead risk analysis, KPI reporting and executive level risk insights.
• Support policy lifecycle, attestations and exception processes across teams.

Conocimientos

Analytical skills

Problem solving

Communication skills

Collaboration

Educación

BS or MS in Business, Computer Science, Information Security or related field

Herramientas

OneTrust GRC

PowerBI

PCI-DSS audit tools

Descripción del empleo

Job Location: Mexico City, MexicoCalling all originals: At Levi Strauss & Co., you can be yourself — and be part of something bigger. We’re a company of people who like to forge our own path and leave the world better than we found it. Who believe that what makes us different makes us stronger. So add your voice. Make an impact. Find your fit — and your future.The Sr. Cyber Risk Analyst will be a member of the Cyber Risk team. The position is responsible for implementing the cyber risk operational strategy, which includes managing the Governance, Risk, and Compliance (GRC) tool, performing internal and 3rd party security risk assessments, and driving effective alignment to the Risk Management policy. The position reports to the Manager, Cyber Risk.About the JobProgram alignment to ISO 27005, CIS Top 18 Controls, and the NIST Cybersecurity Framework.Oversees initial project development surrounding new processes and integrating new processes with existing ones. Communicates these changes to impacted clients and other resources.Support the OneTrust GRC tool responsibilities, escalating any strategic or large decision-making to the risk manager.Assist in tiering the backlog of LS&Co. vendors using the defined vendor tiering criteria and perform internal and 3rd party security risk assessments. Prioritize and select controls based on risk assessment frameworks, and partner with internal stakeholders to document each control.Determine the effectiveness of in-scope controls by implementing the risk management framework aligned to ISO 27005, including management of the security risk policy, control mapping, and implementation of the risk management process in the OneTrust GRC tool.Drive the policy lifecycle management process to manage & govern policies, policy lifecycle, attestation, communication, issue and actions, policy processes, and overall governance; manage the Cyber Risk Policy and make revisions as needed.Manage the day-to-day exception process within the GRC tool for all GIS teams, while maintaining updates to procedures.Assist in the assessment and quantification of GIS identified top risks and critical assets by performing risk analysis to increase awareness and facilitate risk identification activities.Partner with regional BISOs to understand local compliance requirements and perform a risk analysis to support global compliance and other operational risk activities.Manage risk remediation plans, including setting deadlines, following up on progress, and reporting on outcomes to ensure issues are mitigated and managed, risks are accounted for, and security exceptions are tracked in accordance with frameworks, policies, and standards.Responsible for the ongoing management and maintenance of the enterprise cyber risk register, ensuring risks are consistently identified, assessed, and kept current with clear remediation tasks assigned to the appropriate owners and tracked through to resolution.Assist in the development and delivery of risk reporting for senior leadership, translating the state of the risk landscape into actionable insights that drive informed decision-making at the executive level.Partner with stakeholders to develop a continuous control monitoring (CCM) approach by leveraging the GRC tool to build custom workflows and metric dashboards to drive action between risk assessments.Manage and create cyber risk key risk indicators (KRIs) using OneTrust and PowerBI.Drive evidence collection and review as part of the annual PCI-DSS audit, and other compliance obligations as needed.About YouBS or MA in Business, Computer Science, Information Security or a related field.Industry security certifications (i.e., CISSP, CISM, CRISC, etc.) or aspiring to receive one within a year.3+ years of experience working in risk management, governance, and regulatory requirements related to cybersecurity with a specific focus on business outcomes and service delivery.3+ years of experience performing internal and 3rd party risk assessments.Experience with compliance obligations such as PCI-DSS, HIPAA, and SOX3+ years of experience with regulatory compliance and information security management frameworks (e.g., International Organization for Standardization [ISO] 27005, NIST Cybersecurity Framework, CIS Top 18, and MITRE ATT&CK.1-3 years of experience managing a global team of associates and contractors.Knowledge of cybersecurity principles, including risk assessment and management, threat and vulnerability management, incident response, and identity and access managementTechnical proficiency with security-related systems and applicationsExperience in developing, documenting and maintaining security proceduresExcellent analytical and problem-solving skills (ability to find innovative ways to resolve problems)Proven ability to collect, manage, and present data, metrics, and KPIs that tell the story of the company’s security posture.Excellent communication skills in the new world of remote & on-line working and highly collaborative with the ability to influence across the matrix and to build connections to enable successLOCATIONMexico, D.F., MexicoFULL TIME/PART TIMEFull timeCurrent LS&Co Employees, apply via your Workday account.