Information Security Risk Analyst

Fisher Investments; Tampa (FL); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

100% paid medical, dental and vision

401(k) match 50%

20 days PTO + 10 holidays

Family support programs

Hybrid work-from-home option

Job summary

Fisher Investments is seeking an Information Security Risk Analyst to partner with Information Security, Technology and Enterprise Risk Management teams. You will perform technology risk analysis, develop risk practices for Digital Assets and implement controls in support of Fisher’s Digital Asset risk management goals.

You will evaluate inherent risk, research vendor controls, and collaborate with SMEs to ensure effective Digital Asset risk management.

Qualifications

• 3+ years of experience in Enterprise Risk Management for Digital Assets.
• 1+ years of experience in Digital Asset audit review experience (SOC 2 Type II, SOX, PCI).
• Knowledge of Information Security and risk standards/frameworks (NIST 800-53, CIS, OWASP, ISO-27001, ITIL, COSO).
• Experience assessing risk or implementing controls in a cloud-based enterprise environment.
• Extensive knowledge of information systems, risk assessment methodologies and security control technologies such as Okta, EntraID, Splunk, and Netskope.
• Balance risks in ambiguous and complex scenarios.
• Team-oriented, highly collaborative, experienced leading initiatives.
• Experience in GRC platforms.
• Delivery of quality work within an Agile Scrum team.
• Preference for experience in regulated industries: Finance, Healthcare.

Responsibilities

• Represent Information Security in Enterprise Risk Management technology reviews for Digital Assets, including evaluation of inherent risk, researching vendor practices and controls, recommending new practices and controls, and estimating residual risk
• Collaborate with Information Security, Technology, and Data Privacy SMEs to determine efficacy of Digital Asset controls
• Research new possible Digital Asset risk controls
• Perform security-focused risk and gap assessments to identify, document and track security risks associated with Cloud and physical IT infrastructure and services, Applications, Information systems, and Vendors/other third parties
• Identify risk levels and associated controls to manage risk levels applying both quantitative and qualitative techniques
• Assist in maturing Enterprise Risk Management evaluation procedures for Digital Assets
• Translate risk management information from technical to business language
• Provide security risk services to business owners and partners
• Work with project teams to collect and document evidence of cyber control implementation
• Understand and maintain knowledge of methodologies and technologies in risk assessments and controls measures

Skills

ERM for Digital Assets

Risk evaluation processes

Vendor research

SOC 2 Type II / SOX / PCI audits

Security frameworks (NIST 800-53, CIS,

ISO-27001, ITIL, COSO

Cloud risk assessment

Okta / EntraID / Splunk / Netskope

Education

Bachelor's degree in Computer Science / Information Security or equivalent

Tools

Okta

EntraID

Splunk

Netskope

Job description

Overview

It's an exciting time to join Fisher Investments; we're investing in the future of our firm's technology and information security. Our business is growing internationally, which emphasizes the need to build an unparalleled team that promotes future global growth through strategic solutions and progress. We are important to supporting our firm's diverse businesses, and we are excited to continue solidifying that foundation as we add more experienced technologists to our Technology team.

The Opportunity

The Information Security Risk Analyst, reporting to the Vice President - Information Security, will work with Information Security, Technology, Project, and Enterprise Risk Management teams to perform technology risk analysis and recommend controls. You will also develop, recommend, and implement technology risk practices following Fisher Investments Digital Asset risk management goals.

The Day-to-Day

• Represent Information Security in Enterprise Risk Management technology reviews for Digital Assets, including evaluation of inherent risk, researching vendor practices and controls, recommending new practices and controls, and estimating residual risk
• Continuously collaborate with Information Security, Technology, and Data Privacy Subject Matter Experts to determine efficacy of technical and practical Digital Asset controls
• Research new possible technical and practical Digital Asset risk controls
• Perform security-focused risk and gap assessments to identify, document and track security risks associated with Cloud and physical IT infrastructure and services, Applications, Information systems, and Vendors/other third parties
• Identify risk levels and associated controls to manage risk levels applying both quantitative and qualitative techniques
• Assist in continuously maturing Enterprise Risk Management evaluation procedures for Digital Assets
• Translate risk management information from technical to business language
• Provide security risk services to business owners and partners
• Work with project teams to collect and document evidence of cyber control implementation
• Understand and maintain a broad knowledge of methodologies and technologies in risk assessments and controls measures

Your Qualifications

• Bachelor's degree in computer science, Information Security, or related discipline or equivalent experience
• 3+ years of experience in Enterprise Risk Management for Digital Assets, including development of risk evaluation processes, control evaluations and recommendations, and vendor research
• 1+ years of experience in Digital Asset audit review experience (including SOC 2 Type II, SOX compliance, PCI compliance, vulnerability reports, retention policies)
• Knowledge of Information Security and risk standards and frameworks such as NIST 800-53, CIS benchmarks, OWASP, ISO-27001, ITIL and COSO
• Experience assessing risk or implementing controls in a cloud-based enterprise environment
• Extensive knowledge of information systems, risk assessment methodologies and security control technologies such as Okta, EntraID, Splunk, and Netskope
• Balance risks in ambiguous and complex scenarios
• Team-oriented, highly collaborative, experienced leading initiatives
• Experience in GRC platforms
• Deliver quality as part of a Scrum team working in an Agile environment
• Preference given to experience in a regulated industry: Finance, Healthcare, etc.

Why Fisher Investments

We work for a bigger purpose: bettering the investment universe. We take great pride in our inclusive culture, our learning and development framework customized for every employee, and our Great Place to Work Certification. It's the people that make the Fisher purpose possible, and we invest in them by offering exceptional benefits like:

• 100% paid medical, dental and vision premiums for you and your qualifying dependents
• A 50% 401(k) match, up to the IRS maximum
• 20 days of PTO, plus 10 paid holidays
• Family Support programs including 8 week Paid Primary Caregiver Leave, $10,000 fertility, family forming, and hormonal health assistance, and back-up child, adult, and elder care
• This is an in-office role. Based on your role, tenure, and performance eligibility you may have the opportunity to participate in our hybrid work from home program. This program is subject to change.

FISHER INVESTMENTS IS AN EQUAL OPPORTUNITY EMPLOYER