InfoSec Risk & Controls Lead

Bloomberg; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Bloomberg is seeking an Information Security Risk Manager to unite cybersecurity knowledge, risk management disciplines, and strong analytical capabilities in a credible oversight role.

You will report to the Head of Information Security Risk and work with Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management to identify, assess, communicate, and resolve cybersecurity risks across programs.

Qualifications

• Bachelor’s degree or equivalent professional experience.
• 5+ years of relevant experience across Security Engineering, Security Architecture, Application Security or related technical discipline.
• Familiarity with NIST CSF, NIST 800-53, MITRE ATT&CK, ISO 27001, COBIT or CIS.

Responsibilities

• Support Second Line oversight and credible challenge of cybersecurity and information security risks across the organization.
• Assess security risks and consult on the design and effectiveness of security controls.
• Review security programs and initiatives for alignment with enterprise risk standards and regulatory expectations.
• Partner with Information Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management teams to strengthen risk awareness and control ownership.
• Analyze security findings, incidents, control weaknesses and risk scenarios to identify root causes and opportunities for improvement.
• Develop practical recommendations to address identified security and control risks.
• Assist in developing cybersecurity risk assessments, reporting, metrics and materials for governance forums.
• Monitor emerging threats, regulatory developments and industry practices for relevance.

Education

Bachelor's degree or equivalent

Job description

Bloomberg is seeking an Information Security Risk Manager to unite cybersecurity knowledge, risk management disciplines, and strong analytical capabilities in a credible oversight role.

You will report to the Head of Information Security Risk and work with Security, CISO, Engineering, Technology Risk, and Enterprise Risk Management to identify, assess, communicate, and resolve cybersecurity risks across programs.