SrMgr-Information Security- Vendor Risk Management
3 weeks ago
Job Number 24070949
Job Category Information Technology
Location Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United States
Schedule Full-Time
Located Remotely? Y
Relocation? N
Position Type Management
JOB SUMMARY
The candidate will be responsible for completing and maintaining 3rd Party Hosting Service Provider reviews, including creating risk assessments, and security test and evaluations. The candidate will also be responsible for supporting the overall security program including security policy, procedures, and standards, assessing the risk of the internal and external IT systems, ensuring Marriott iT documents are compliant with Marriott security policies and procedures, and reviewing documents for accuracy and completeness.
Conduct periodic re-assessment with focus on those with highly sensitive data. Perform application security vulnerability scanning and provide remediation options. Candidate will also assist in managing relationship with Service Providers who are responsible for the actual delivery of services, managing outcomes and results, and collaborating with stakeholders across IT and business departments to develop strategies for securing company information and assets. Shares responsibility for planning, directing, and coordinating compliance activities pertaining to technology projects for a given business unit. Verifies that project goals are accomplished and in line with business objectives.
Excellent communication skills are required to effectively communicate (verbally and written) across all levels within the organization.
CANDIDATE PROFILE
Education and Experience
Required:
Bachelor’s degree in Information Systems or related field or equivalent experience/certification
7+ years of information technology leadership experience including implementing, managing and governing security policies
3+ years direct work experience in third-party Risk Management
One or more current information security certifications such as Certified in Risk and Information Systems Controls (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)
Preferred:
A security certification such as GWAPT, GPEN, AWS Associate Architect, AWS Professional Architect, PCI experience.
Technical knowledge in one or more of the following areas is required: Application Security, Operating System security (UNIX, Windows, Mainframe, etc.) and network security (routers, switches, firewalls)
Technical leadership experience in an outsourced environment
Excellent communication skills and problem-solving ability
Experience conducting and maintaining vendor risk assessments
Experience with reviewing and assessing security controls of Cloud service providers
Proficient with assessing a multi-tiered system architecture (Web Server, App Server & Database)
Knowledge of OWASP Top 10 and SANS 25.
Working knowledge of the infrastructure and application scanning tools (such as Retina, Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, etc.)
Manual Web Application Testing experience.
CORE WORK ACTIVITIES
Security Risk & Compliance
Oversee, evaluate, and support the documentation, and validation processes necessary to assure that associates, information technology systems and business processes meet the organization’s information assurance, security, and privacy requirements. Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations.
Perform security controls assessments of third-party providers – assess security architecture, adherence to the requirements, conduct application scanning and results validation
Document controls gap analysis and risk assessment of the third-party providers
Review controls exception requests and make risk-based approval decision
Lead, participate or perform various infrastructure compliance initiatives and projects
Perform Application Security Testing using (Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, Burp, or Retina)
Conduct and validate finding discovered during the scans
Monitor compliance to applicable security policies and standards and report related risk issues
Manage and administer processes and tools that enable the organization to identify, document, and track third party risks and compliance exceptions
Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures.
Provide sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocate policy changes and make a case on behalf of the company via a wide range of written and oral work products.
Oversee the information assurance (IA) program of an information system in or outside the network environment; may include procurement duties.
Maintaining Goals
Submits reports in a timely manner, ensuring delivery deadlines are met.
Promotes the documenting of project progress accurately.
Provides input and assistance to other teams regarding projects.
Managing Work, Projects, and Policies
Manages and implements work and projects as assigned.
Generates and provides accurate and timely results in the form of reports, presentations, etc.
Analyzes information and evaluates results to choose the best solution and solve problems.
Provides timely, accurate, and detailed status reports as requested.
Demonstrating and Applying Discipline Knowledge
Provides technical expertise and support to persons inside and outside of the department.
Demonstrates knowledge of job-relevant issues, products, systems, and processes.
Demonstrates knowledge of function-specific procedures.
Keeps up-to-date technically and applies new knowledge to job.
Uses computers and computer systems (including hardware and software) to enter data and/ or process information.
Delivering on the Needs of Key Stakeholders
Understands and meets the needs of key stakeholders.
Develops specific goals and plans to prioritize, organize, and accomplish work.
Determines priorities, schedules, plans and necessary resources to ensure completion of any projects on schedule.
Collaborates with internal partners and stakeholders to support business/initiative strategies
Communicates concepts in a clear and persuasive manner that is easy to understand.
Generates and provides accurate and timely results in the form of reports, presentations, etc.
Demonstrates an understanding of business priorities
Additional Responsibilities
Provides information to supervisors and co-workers by telephone, in written form, e-mail, or in person in a timely manner.
Demonstrates self-confidence, energy and enthusiasm.
Informs and/or updates leaders on relevant information in a timely manner.
Manages time effectively and conducts activities in an organized manner.
Presents ideas, expectations and information in a concise, organized manner.
Uses problem solving methodology for decision making and follow up.
Performs other reasonable duties as assigned by manager.
California Applicants Only: The salary range for this position is $96,038.00 to $209,169.00 annually.
Colorado Applicants Only: The salary range for this position is $96,038.00 to $190,154.00 annually.
Hawaii Applicants Only: The salary range for this position is $116,205.00 to $209,169.00 annually.
New York Applicants Only: The salary range for this position is $96,038.00 to $209,169.00 annually.
Washington Applicants Only: The salary range for this position is $96,038.00 to $209,169.00 annually. In addition to the annual salary, the position will be eligible to receive an annual bonus. Employees will accrue 0.04616 PTO balance for every hour worked and eligible to receive minimum of 7 holidays annually.
All locations offer coverage for medical, dental, vision, health care flexible spending account, dependent care flexible spending account, life insurance, disability insurance, accident insurance, adoption expense reimbursements, paid parental leave, educational assistance, 401(k) plan, stock purchase plan, discounts at Marriott properties, commuter benefits, employee assistance plan, and childcare discounts. Benefits are subject to terms and conditions, which may include rules regarding eligibility, enrollment, waiting period, contribution, benefit limits, election changes, benefit exclusions, and others.
Marriott HQ is committed to a hybrid work environment that enables associates to Be connected. Headquarters-based positions are considered hybrid, for candidates within a commuting distance to Bethesda, MD; candidates outside of commuting distance to Bethesda, MD will be considered for Remote positions.
The application deadline for this position is 28 days after the date of this posting, 4/22/2024.
Marriott International is an equal opportunity employer. We believe in hiring a diverse workforce and sustaining an inclusive, people-first culture. We are committed to non-discrimination on any protected basis, such as disability and veteran status, or any other basis covered under applicable law.
Marriott International is the world’s largest hotel company, with more brands, more hotels and more opportunities for associates to grow and succeed. Be where you can do your best work, begin your purpose, belong to an amazing global team, and become the best version of you.
-
SrMgr-Information Security
2 days ago
Oklahoma City, Oklahoma, United States Marriott Full timeJob Number Job Category Information TechnologyLocation Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United StatesSchedule Full-TimeLocated Remotely? YRelocation? NPosition Type ManagementJOB SUMMARYThe Sr. Application Security Manager is responsible for the oversight of the security components of web application projects, ensuring...
-
Mg - Information Security - Data Governance
3 weeks ago
Oklahoma City, Oklahoma, United States Marriott Full timeAdditional Information Please post for 15 days--contractor conversionsJob Number Job Category Information TechnologyLocation Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United StatesSchedule Full-TimeLocated Remotely? YRelocation? NPosition Type ManagementJOB SUMMARYThe Manager will support the implementation, and maintenance of the...
-
Sr. Information Risk Associate
2 weeks ago
Texas City, United States Saxon Global Full timeOverview: The Sr. Associate for Information Risk Management is responsible for the strategic development, implementation, and effective execution of activities in the Information Risk Management (IRM) program. The key program elements of which cover include internal loss, external loss, risk assessment, business impact assessments, KRIs, scenario analysis...
-
Vendor Risk Associate
3 weeks ago
Jersey City, United States SMBC Group Full timeThe anticipated salary range for this role is between $80,000.00 and $124,000.00. The specific salary offered to an applicant will be based on their individual qualifications, experiences, and an analysis of the current compensation paid in their geography and the market for similar roles at the time of hire. The role may also be eligible for an annual...
-
IT Security Risk Analyst
3 weeks ago
Oklahoma City, Oklahoma, United States Two95 International Inc. Full timeTitle: Information Security Risk Analyst Location: Oklahoma City, OK Type: Full-time Salary: DOE Requirement: Under senior staff supervision, assist in information security policy development, maintenance and auditing; security policy education, training, and awareness activities; monitor compliance with security policy and applicable law....
-
USDA-Vendor Manager
3 weeks ago
Oklahoma City, Oklahoma, United States ISN Corporation Full timeJob Description ISN is seeking a Vendor Manager to be responsible for assisting the vendor technicians as it relates to managing, preserving, and disposing of single-family homes (1-4 units) Real Estate Owned (REO) and custodial properties. The Vendor Manager must ensure that subcontractors are qualified, trained, and able to conduct and submit work product...
-
Compliance and Operational Risk Manager
3 weeks ago
Jersey City, United States Bank of America Full timeDescription : At Bank of America, we are guided by a common purpose to help make financial lives better through the power of every connection. Responsible Growth is how we run our company and how we deliver for our clients, teammates, communities and shareholders every day. One of the keys to driving Responsible Growth is being a great place to work...
-
Salt Lake City, United States Marriott Full timeJob Number 24072925 Job Category Information Technology Location Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United States Schedule Full-Time Located Remotely? Y Relocation? N Position Type Management JOB SUMMARY Establishes and leads the processes for Security Engagement Review (SER) Process to ensure they are performed in...
-
Third Party Risk Management Senior Analyst
4 days ago
Jersey City, New Jersey, United States Verisk Full timeJob Description Working as part of a team, the analyst will leverage various sources of data to classify and assess the security program and associated practices of Verisk Analytics suppliers, highlight risks and control gaps associated with the supplier's security program, categorize the potential risks based on severity, and identify potential mitigation...
-
Armed Security Guard
3 weeks ago
Oklahoma City, United States Executive Security Professionals & Full timeJob DescriptionJob DescriptionWe are seeking an Armed Security Guard to become an integral part of our team. The selected individual will patrol and secure assigned premises as well as identify risks to staff and patrons. This will be a part-time postion on Fridays from 2pm-6pm at a site in N. OKC and Saturday from 10pm-3am in Norman. There may be some...
-
Dir-Information Security
3 weeks ago
Oklahoma City, Oklahoma, United States Marriott Full timeJob Number Job Category Information TechnologyLocation Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United StatesSchedule Full-TimeLocated Remotely? YRelocation? NPosition Type ManagementJOB SUMMARY:We are seeking an experienced Cybersecurity Director to lead our organization's efforts in developing and maintaining robust analytical...
-
Information Systems Security Compliance Manager
2 weeks ago
Carson City, United States Bay Area TeK Solutions LLC Full timeJob DescriptionJob DescriptionInformation Systems Security Compliance ManagerLocation: Carson City, NV ( REMOTE )Position DescriptionInformation Technology (IT) Professionals analyze, develop, implement, maintain, and modify computer operations, systems, networks, databases, applications, and/or information security. Incumbents may perform duties in one or...
-
Sr. Cyber Risk Engineer
2 weeks ago
Idaho City, United States Lamb Weston Full timeRequisition Number: Req-231833 Position Title:External Description: Lead and coordinate cross functional teams to develop and implement the information security Governance, Risk, and Compliance strategy, portfolio, programs and projects Research, analyze, communicate and drive related stakeholder, legal and regulatory requirements, standards, industry...
-
Sr. Cyber Risk Engineer
3 days ago
Idaho City, United States Lamb Weston Full timeRequisition Number: Req-231833 Position Title:External Description: Lead and coordinate cross functional teams to develop and implement the information security Governance, Risk, and Compliance strategy, portfolio, programs and projects Research, analyze, communicate and drive related stakeholder, legal and regulatory requirements, standards, industry...
-
Business Unit Information Security Officer
3 weeks ago
Kansas City, United States Hallmark Full time**Business Unit Information Security Officer (BISO)- Remote** **Location:** Kansas City, MO, US, 64108 * Implementation of the corporate information security, data protection and privacy policies across the business. * Plan and manage the network architecture and compliance through direct collaboration with BU leaders, auditors and certification bodies. *...
-
Program Manager
5 days ago
Oklahoma City, United States Cornerstone OnDemand Full timeThe Program Manager for Cornerstone is responsible for managing and implementing a comprehensive security program for the company's portfolio of applications. This involves identifying and assessing potential security risks, developing policies and procedures to mitigate those risks, and ensuring that those policies are effectively implemented throughout the...
-
Armed Security Officer
1 day ago
Oklahoma City, United States Securitas Security Services USA, Inc. Full timeArmed Security Officer We help make your world a safer place. Securitas is a global company that offers the most advanced and sustainable security solutions in the industry. We are located in 47 countries and have 355,000 employees worldwide and over 150,000 clients. Securitas plays an essential role for our clients and in society. The Armed Security Officer...
-
Armed Security Officer
2 days ago
Oklahoma City, Oklahoma, United States Securitas Security Services USA, Inc. Full timeArmed Security Officer We help make your world a safer place. Securitas is a global company that offers the most advanced and sustainable security solutions in the industry. We are located in 47 countries and have 355,000 employees worldwide and over 150,000 clients. Securitas plays an essential role for our clients and in society. The Armed Security Officer...
-
Carson City, United States Novalink Solutions Full timeJob Description Position Description Information Technology (IT) Professionals analyze, develop, implement, maintain, and modify computer operations, systems, networks, databases, applications, and/or information security. Incumbents may perform duties in one or more IT specialization areas depending on the needs of the agency. Incumbents perform supervisory...
-
Security Consultant
4 weeks ago
Oklahoma City, Oklahoma, United States Kyndryl Full timeWho We AreAt Kyndryl, we design, build, manage and modernize the mission-critical technology systems that the world depends on every day. So why work at Kyndryl? We are always moving forward – always pushing ourselves to go further in our efforts to build a more equitable, inclusive world for our employees, our customers and our communities.The RoleAt...