Lead, Risk Management

The Estée Lauder Companies Inc.; New York (NY); Presencial; USD 120 000 - 180 000; Tempo integral

Resumo da oferta

The Estée Lauder Companies Inc. seeks a Cybersecurity Risk Management Lead within ECR’s Risk and Solutions team to minimize security risk by identifying risks, monitoring workflows, providing risk scoring, and presenting data to leadership for a holistic view.

You will partner with IT and business owners to assess technology risks, define remediation paths, manage cross‑functional projects, maintain risk trackers, support governance meetings, and deliver KRIs and dashboards with Power BI.

Qualificações

• 5+ years of practical experience in technology risk and controls or IT audit.
• Strong communication, influence, and stakeholder management skills.
• Ability to solve problems, think creatively, and manage ambiguity.
• Experience presenting to executives and driving cross‑functional collaboration.
• Undergraduate degree in computer science or business or equivalent; CISSP/CISA/CISM desirable.

Responsabilidades

• Partner with IT and business owners to identify and evaluate cyber risks and set remediation paths.
• Review risks through triage, score risk level and severity, and escalate as needed.
• Maintain risk reduction trackers and basic project management documentation.
• Prepare reporting and dashboards (KRI) on a scheduled basis.
• Coordinate across cross‑functional teams to track remediation status and governance updates.

Conhecimentos

Risk management

Communication

Analytical skills

Problem solving

Project governance

Formação académica

Undergraduate degree in CS/Business

CISSP/CISA/CISM/CRISC/ITIL desirable

Ferramentas

Power BI

Excel

PowerPoint

Word

Descrição da oferta de emprego

Risk Management Lead
As the Cybersecurity Risk Management Lead within ECR’s Risk and Solutions team, you will work to minimize overall security risk by identifying risks, monitoring requests through approval workflows, providing risk scoring, and presenting data to give a holistic view of the risk associated with risks identified at the company.

Responsibilities Include

• Partner with ECR team members, IT stakeholders, and business owners to bring down the risk of technology to the company by identifying and evaluating technology and cyber risks as they are identified. Responsible for reviewing risks through triage and evaluative score risk level and severity with a focus on defining a potential path for remediation
• Collaborate to define appropriate solutions to mitigate or remediate the risk by partnering with key stakeholders in ECR, IT, and the business, which will require consensus building and managing disagreements. Enable balanced risk decisions by providing recommendations to leadership, escalating based on severity and risk level to ensure appropriate cyber protection capabilities and resiliency are built into the plans.
• Manage risk reduction tracker and maintain basic project management documentation tracking project tasks, status, ownership, issue closure, and timelines.
• Support monthly Risk Reduction Governance Committee meetings.
• Coordinate and manage cross-functional project teams to track overall remediation status while coordinating with applicable team and Program Managers.
• Prepare and provide reporting (KRI) and dashboard status(s) on a scheduled basis.

Qualifications

• 5 years of practical experience in technology risk and control or IT audit (audit firm experience is a plus), including experience in project governance/management and understanding of business processes, key IT risk/controls, organizations, markets, retail, and/or manufacturing.
• Strong communication skills, influence/negotiation skills, attention to detail, conflict management experience, analytical skills, and measurement/visualization ideas.
• Ability to problem⁃solve, think creatively, challenge the status quo, and manage ambiguity.
• Ability to communicate complicated or technical information to executives, including proven ability to work both independently and as part of a team, with stakeholders at all levels.
• Proficient in Microsoft Excel, Word, and PowerPoint, including data visualization Power BI.
• Proficient in English as a business language.
• Experience handling, securing, and communicating highly confidential and sensitive information.
• 3 years minimum related experience.
• Undergraduate degree in computer science/business or equivalent professional experience CISSP/CISA/CISM/CRISC/CGEIT/ITIL or equivalent certification is desirable.