SrMgr-Information Security- Vendor Risk Management

3 weeks ago

Montgomery County, United States Corporate Full time

JOB SUMMARY

The candidate will be responsible for completing and maintaining 3rd Party Hosting Service Provider reviews, including creating risk assessments, and security test and evaluations. The candidate will also be responsible for supporting the overall security program including security policy, procedures, and standards, assessing the risk of the internal and external IT systems, ensuring Marriott iT documents are compliant with Marriott security policies and procedures, and reviewing documents for accuracy and completeness.

Conduct periodic re-assessment with focus on those with highly sensitive data. Perform application security vulnerability scanning and provide remediation options. Candidate will also assist in managing relationship with Service Providers who are responsible for the actual delivery of services, managing outcomes and results, and collaborating with stakeholders across IT and business departments to develop strategies for securing company information and assets. Shares responsibility for planning, directing, and coordinating compliance activities pertaining to technology projects for a given business unit. Verifies that project goals are accomplished and in line with business objectives.

Excellent communication skills are required to effectively communicate (verbally and written) across all levels within the organization.

CANDIDATE PROFILE

Education and Experience

Required:

Bachelor’s degree in Information Systems or related field or equivalent experience/certification 7+ years of information technology leadership experience including implementing, managing and governing security policies 3+ years direct work experience in third-party Risk Management One or more current information security certifications such as Certified in Risk and Information Systems Controls (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)

A security certification such as GWAPT, GPEN, AWS Associate Architect, AWS Professional Architect, PCI experience.

Technical knowledge in one or more of the following areas is required: Application Security, Operating System security (UNIX, Windows, Mainframe, etc.) and network security (routers, switches, firewalls)  Technical leadership experience in an outsourced environment Excellent communication skills and problem-solving ability Experience conducting and maintaining vendor risk assessments Experience with reviewing and assessing security controls of Cloud service providers Proficient with assessing a multi-tiered system architecture (Web Server, App Server & Database) Knowledge of OWASP Top and SANS . Working knowledge of the infrastructure and application scanning tools (such as Retina, Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, etc.) Manual Web Application Testing experience.

CORE WORK ACTIVITIES

Security Risk & Compliance

Oversee, evaluate, and support the documentation, and validation processes necessary to assure that associates, information technology systems and business processes meet the organization’s information assurance, security, and privacy requirements. Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations. Perform security controls assessments of third-party providers – assess security architecture, adherence to the requirements, conduct application scanning and results validation Document controls gap analysis and risk assessment of the third-party providers Review controls exception requests and make risk-based approval decision Lead, participate or perform various infrastructure compliance initiatives and projects Perform Application Security Testing using (Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, Burp, or Retina)  Conduct and validate finding discovered during the scans Monitor compliance to applicable security policies and standards and report related risk issues Manage and administer processes and tools that enable the organization to identify, document, and track third party risks and compliance exceptions Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures. Provide sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocate policy changes and make a case on behalf of the company via a wide range of written and oral work products. Oversee the information assurance (IA) program of an information system in or outside the network environment; may include procurement duties.

Maintaining Goals

Submits reports in a timely manner, ensuring delivery deadlines are met. Promotes the documenting of project progress accurately. Provides input and assistance to other teams regarding projects.

Managing Work, Projects, and Policies 

Manages and implements work and projects as assigned. Generates and provides accurate and timely results in the form of reports, presentations, etc. Analyzes information and evaluates results to choose the best solution and solve problems. Provides timely, accurate, and detailed status reports as requested.

Demonstrating and Applying Discipline Knowledge 

Provides technical expertise and support to persons inside and outside of the department. Demonstrates knowledge of job-relevant issues, products, systems, and processes. Demonstrates knowledge of function-specific procedures. Keeps up-to-date technically and applies new knowledge to job. Uses computers and computer systems (including hardware and software) to enter data and/ or process information.

Delivering on the Needs of Key Stakeholders

Understands and meets the needs of key stakeholders. Develops specific goals and plans to prioritize, organize, and accomplish work. Determines priorities, schedules, plans and necessary resources to ensure completion of any projects on schedule. Collaborates with internal partners and stakeholders to support business/initiative strategies Communicates concepts in a clear and persuasive manner that is easy to understand. Generates and provides accurate and timely results in the form of reports, presentations, etc. Demonstrates an understanding of business priorities

Additional Responsibilities 

Provides information to supervisors and co-workers by telephone, in written form, e-mail, or in person in a timely manner. Demonstrates self-confidence, energy and enthusiasm. Informs and/or updates leaders on relevant information in a timely manner. Manages time effectively and conducts activities in an organized manner. Presents ideas, expectations and information in a concise, organized manner. Uses problem solving methodology for decision making and follow up. Performs other reasonable duties as assigned by manager. California Applicants Only: The salary range for this position is to annually.

Colorado Applicants Only: The salary range for this position is to annually.

Hawaii Applicants Only: The salary range for this position is to annually.

New York Applicants Only: The salary range for this position is to annually.

Washington Applicants Only: The salary range for this position is to annually. In addition to the annual salary, the position will be eligible to receive an annual bonus. Employees will accrue PTO balance for every hour worked and eligible to receive minimum of 7 holidays annually.

All locations offer coverage for medical, dental, vision, health care flexible spending account, dependent care flexible spending account, life insurance, disability insurance, accident insurance, adoption expense reimbursements, paid parental leave, educational assistance, (k) plan, stock purchase plan, discounts at Marriott properties, commuter benefits, employee assistance plan, and childcare discounts. Benefits are subject to terms and conditions, which may include rules regarding eligibility, enrollment, waiting period, contribution, benefit limits, election changes, benefit exclusions, and others.

Marriott HQ is committed to a hybrid work environment that enables associates to Be connected. Headquarters-based positions are considered hybrid, for candidates within a commuting distance to Bethesda, MD; candidates outside of commuting distance to Bethesda, MD will be considered for Remote positions.

The application deadline for this position is days after the date of this posting, 4//4.
 

  • SrMgr-Information Security- Vendor Risk Management

    2 weeks ago

    Montgomery, United States Marriott Full time

    Job Number 24070949 Job Category Information Technology Location Marriott International HQ, 7750 Wisconsin Avenue, Bethesda, Maryland, United States Schedule Full-Time Located Remotely? Y Relocation? N Position Type Management JOB SUMMARY The candidate will be responsible for completing and maintaining 3rd Party Hosting Service Provider reviews,...

  • SrMgr-Global Information Security

    3 weeks ago

    Montgomery County, United States Corporate Full time

    JOB SUMMARYThe Senior Manager is responsible for leading and coordinating, articulating, and tracking actions related to developing and driving the implementation of cyber security risk management plans, ensuring effective cyber security risk management practices, and engaging with business unit members on a wide range of cyber security matters to achieve...

  • Information Security Analyst

    4 weeks ago

    Kauai County, United States Watershed Security Full time

    Job DescriptionJob DescriptionCOMPANY OVERVIEWWatershed Security is a Veteran Owned Small Business and a leader in providing quality Cyber Security Services to the Federal Government. Watershed is a great place to work, offering a challenging and respectful work environment. We are growing fast and strive to deliver our vision every day: “To inspire trust...

  • Senior Information Security Analyst

    1 month ago

    Kauai County, United States Watershed Security Full time

    Job DescriptionJob DescriptionCOMPANY OVERVIEWWatershed Security is a Veteran Owned Small Business and a leader in providing quality Cyber Security Services to the Federal Government. Watershed is a great place to work, offering a challenging and respectful work environment. We are growing fast and strive to deliver our vision every day: “To inspire trust...

  • Operations Manager- Security

    1 day ago

    Montgomery, United States Brosnan Risk Consultants Full time

    Company Overview/Benefits: Brosnan is looking for an Security Operations Manager in Montgomery AL! Here at Brosnan Risk Consultants, our culture encourages and supports diversity throughout the workplace! We offer both full-time and part-time opportunities. We also pride ourselves on promoting within. Many of our employees began their careers as security...

  • Information System Security Manager ISSM

    1 day ago

    Montgomery, United States Vectrus Full time

    Overview Working across the globe, V2X builds smart solutions designed to integrate physical and digital infrastructure from base to battlefield. We bring 120 years of successful mission support to improve security, streamline logistics, and enhance readiness. Aligned around a shared purpose, our $3.9B company and 16,000 people work alongside our clients,...

  • Information System Security Manager ISSM

    5 hours ago

    Montgomery, United States Vectrus Full time

    Overview Working across the globe, V2X builds smart solutions designed to integrate physical and digital infrastructure from base to battlefield. We bring 120 years of successful mission support to improve security, streamline logistics, and enhance readiness. Aligned around a shared purpose, our $3.9B company and 16,000 people work alongside our clients,...

  • Information System Security Manager ISSM

    21 hours ago

    Montgomery, United States Vectrus Full time

    Overview Working across the globe, V2X builds smart solutions designed to integrate physical and digital infrastructure from base to battlefield. We bring 120 years of successful mission support to improve security, streamline logistics, and enhance readiness. Aligned around a shared purpose, our $3.9B company and 16,000 people work alongside our clients,...

  • Cybersecurity Engineer

    1 month ago

    Montgomery, United States Optimized Technical Solutions Full time

    Job DescriptionJob DescriptionDescriptionOptimized Technical Solutions (OTS) is currently seeking a qualified Cybersecurity Engineer - Information Security System Officer (ISSO). This is an in-person position and must be located near JBSA, WPAFB, or Gunter.Provides guidance, oversight, and expertise on the overall security of DoD information systemsPerforms...

  • Security Guard

    1 week ago

    Erie County, United States Excelsior Management Full time

    Job DescriptionJob DescriptionHIRING NOW!!!SIGN ON BONUSWe are seeking a Security Guard to become an integral part of our team. The selected individual will patrol and secure assigned premises as well as identify risks to staff and patrons.Responsibilities:Monitor premises to prevent theft, violence, or infractions of rulesThoroughly examine doors,...

  • Director, Product Security

    1 month ago

    Rockland County, United States Vertex Inc Full time

    Description : This position is responsible for defining and implementing Vertex’s product security strategy, partnering closely with product development, IT, legal and other organizations to oversee and drive critical cyber risk programs from start to finish. You will lead a team of talented and experienced Information Security professionals...

  • Sr. Information Systems Security Analyst

    21 hours ago

    Montgomery, United States JYG Innovations Full time

    Note: Legitimate correspondence for these positions will only come from @jyginnovations.com or from isolvedSenior Information Systems Security Analyst About JYG Innovations JYG Innovations (JYG) is a professional solutions and services company focused on providing innovative and exceptional service in the Defense, State/Local and Commercial sectors. With a...

  • Sr. Information Systems Security Analyst

    2 days ago

    Montgomery, United States JYG Innovations Full time

    Note: Legitimate correspondence for these positions will only come from @jyginnovations.com or from isolved Senior Information Systems Security Analyst About JYG Innovations JYG Innovations (JYG) is a professional solutions and services company focused on providing innovative and exceptional service in the Defense, State/Local and Commercial sectors. With...

  • Armed Security Guard

    1 month ago

    Orange County, United States Star Pro Security Full time

    Job DescriptionJob DescriptionOverview:Do you have a full-time job but looking or addional hours? Star Pro Security Patrol, Inc. is seeking a competent and reliable Armed Security Officer to safeguard our client's premises, assets, and personnel. The ideal candidate will be a highly trained individual capable of handling firearms responsibly and...

  • Retail Security

    1 month ago

    Nassau County, United States SSAG Armed Security & Consulting Full time

    Job DescriptionJob DescriptionWe are seeking a Security Agent - For Corporate Security Front Desk and Luxury/High End Retail to become an integral part of our team. The hours are during the day from 8am -6pm and we are have openings on all days. The selected individual will patrol and secure assigned premises as well as identify risks to staff and patrons....

  • MMIS (Medicaid Management Information System) Consultant

    1 hour ago

    Montgomery, United States MM International Full time

    Job DescriptionJob DescriptionJob Title: Business Analyst (MMIS Consultant)Location: Montgomery AL day 1, 100% onsiteDuration: 12+ Month ContractFor years, Medicaid services followed a monolithic system that every state Medicaid service followed nationwide. A new director wants to do away with this and implement a more interoperable, modular system based on...

  • 26 NOS - IA - Information Assurance Manager (IAM) - Mid

    2 weeks ago

    Montgomery, United States SMS Data Products Group Full time

    Overview SMS is seeking highly motivated experienced Information Assurance Manager in support of a dynamic team at Maxwell AFB, Gunter Annex, AL.  Support the ISSM maintaining the authorization of the system throughout its lifecycle. Provide support and technical expertise related to Defense in Depth principles and technology in security engineering designs...

  • Security Installation Technician

    1 month ago

    San Diego County, United States Halcyon Mobile Security Solutions Full time

    Job DescriptionJob DescriptionJob SummaryInstalls, programs, maintains, or repairs security or alarm wiring and equipment in accordance with relevant codes. General AccountabilitiesExamines systems to locate problems, such as loose connections or broken insulation.Cabling RJ59, CAT5, CAT6 and termination of RJ45, CAT5Tests backup batteries, keypad...

  • Investigator

    1 day ago

    Montgomery, United States Ethos Risk Full time

    Investigator Montgomery County, AL, USA 23-40 per hour Hourly Part Time Ethos Risk Services is continuing to expand our team of Private Field Surveillance Investigators ! We are looking for Experienced Licensed Investigators to investigate fraud and conduct covert surveillance in the field (from your vehicle). Ethos Risk is one of the...

  • Support Specialist- Investigations

    1 week ago

    Montgomery County, United States Corporate Full time

    JOB SUMMARY The mission of the Global Safety & Security (GSS) organization is to minimize controllable losses by providing Marriott Lodging with technical expertise and training resources in the areas of safety and security management, leading to an environment free from harm for our guests and associates. As a subgroup within the GSS organization, the...