Financial Services Office – Advisory Services Manager – IT Risk & Assurance – Information Security recruitment
Being part of a dynamic, growing organization offers an exciting career path full of opportunity. Ernst Young's Financial Services Office (FSO) is a unique, industry-focused business unit that provides a broad range of integrated services which leverage deep industry experience with strong functional capability and product knowledge. With a client base that includes financial institutions and other capital markets participants, there's tremendous potential for growth - and we're prepared to tap into that potential. Our FSO team takes a strategic approach to helping clients mitigate risk while improving and sustaining their business performance. In today's complex business environment, that means understanding the relationship between risk, the regulatory environment, and performance improvement, and applying our knowledge to help clients achieve their business objectives. When you're on our FSO team, you specialize in a particular competency - Risk, Performance Improvement, or IT Risk Assurance - all as part of a world class, cross-functional team. You also have the opportunity to work across disciplines with professionals who have broad financial services industry sector experience and deep subject-matter knowledge. In FSO, our growth strategy focuses on being account-centric, issue-based and competency-driven. That's what differentiates Ernst Young in the marketplace. The time is now. If you are interested in being part of a dynamic team, serving clients and reaching your full potential - Ernst Young's Financial Services Office is for you. Information Technology Advisory Services (ITAS), part of our Financial Services Office, focuses on the needs of financial institutions including commercial banks, investment banks, broker-dealers, asset managers, insurance companies and energy trading companies. Our ITAS practice helps these institutions evaluate and enhance their business. In Advisory, our growth strategy focuses on being account-centric, issue-based and competency-driven. That's what differentiates Ernst Young in the Advisory marketplace. Information technology is a key enabler, and we're integrating IT into our Advisory transformation engagements. Our IT Risk Assurance team delivers world-class information technology advice as part of our broader risk and business improvement services. We provide services such as financial audit IT integration, third party reporting, IT Risk and Compliance Advisory, information management and analysis, and information security. IT Risk Assurance's Information Security sub-service line provides knowledge in leading practices and methods in the space of information security across asset management, banking, capital markets and insurance sectors. This team helps our clients assess, design, implement and maintain a secure and high performance business environment. Services include:
- Security strategy - Assess, design and implement a security strategy and governance program framework that describes the process, controls, organization and infrastructure to manage information security related concerns.
- Security implementation - Design, implement and integrate security solutions to address enterprise risks and exposures.
- Security governance - Design and implement security policies, procedures and standards that describe pragmatic, risk-based mechanisms to maintain the confidentiality, integrity and availability of information systems and the data processed therein.
- Security monitoring - Design and implement security solutions to monitor the efficiency and effectiveness of security operations, controls and infrastructure.
Two key themes that span our Information Security sub-service line are Data Protection (DP) and Identity Access Management (IAM) services. Ernst Young is currently seeking a Manager to become a member of the Information Security sub-service line. ResponsibilitiesDeliver information security projects, within the financial services sector, as part of an integrated team of FSO professionals Define technical and business requirements for information security solutions Define information security processes and policies which secure and enable the business Enforce business, privacy and security policies Implement IT and information security related technology products Review, assess, benchmark and develop issue remediation action plans for all aspects of information security programs and technologies Develop information security strategies, architectures and implementation plans Plan and execute engagements. Responsibilities include:
- Project planning - project charters, project plans, staffing and resource requirements, budgets and timelines
- Leading engagement delivery teams - on-site team leader, primary interface to client, team mentor
- Manage engagement communications - executive dashboards, status reporting, issue risk tracking
Perform basic supervisory duties to mentor and coach junior staff. Develop people through effectively delegating tasks and providing guidance to staff. Assign and review the work of more junior employees and assist in the preparation of the final work products in order to confirm the work is performed with the highest quality standards. Provide performance feedback and training, and conduct performance reviews. Foster an efficient, innovative, and team-oriented work environment. To qualify, candidates must have:
- a bachelor's degree and a minimum of 5 years of related work experience; or a graduate degree and approximately 4 years of related work experience
- 4+ years of related work experience in developing, implementing or architecting information security systems
- 4+ years of relevant experience at a financial services company or comparable experience working as an advisor to a financial services company
- a strong understanding of information security regulatory requirements and compliance issues
- knowledge of general security concepts and methods such as vulnerability assessments, privacy assessments, intrusion detection, incident response, security policy creation, enterprise security strategies, architectures and governance
- understanding of networking (TCP/IP, OSI model), operating system fundamentals (Windows, UNIX, mainframe), security technologies (firewalls, IDS/IPS, etc.) and application programming/scripting languages (C, Java, Perl, Shell)
- strong existing relationships within the Information Security or IT executive ranks (e.g., CIO, CISO, Director of Information Security, SVP and VP of Information Security) of the financial services sector.
- project management of information security projects including development of project charters and plans; management of project execution and successful implementation of the planned solution
- experience in process definition, workflow design and process mapping
- demonstrated ability to contribute to the development of client deliverables and technical content
- advanced written and verbal communications skills
- excellent leadership and teaming skills
- demonstrated integrity within a professional environment
- CISSP is required. Non-certified hires are required to become certified within 1 year from the date of hire.
- ability to travel at least 50%
Experience in at least one of the following areas:
- Data Protection
- Data classification
- Email surveillance
- Information boundaries
- Encryption (Whole disk, end-to-end email, key management, database, etc)
- Experience developing DP strategies, architectures and implementation plans
- Identity and access management
- User provisioning process and lifecycle
- Enterprise directory architecture and design
- Role based access control
- Entitlement review and certification
- Entitlement management
- Single sign on
- Identity federation
- Privileged access management
- Experience developing IAM strategies, architectures and implementation plans
Experience implementing and integrating products such as:
- Data Protection products
- Symantec Data Loss Prevention products (formerly Vontu)
- RSA Data Loss Prevention Suite
- Websense
- Titus Labs
- Varonis DatAdvantage and DataPrivilege
- Identity and Access Management products
- Oracle Identity Management
- Sun Identity Manager
- IBM Tivoli Identity Manager
- Aveksa Compliance Manager
- SailPoint IdentityIQ
Additional Skills Desired:
- CISA, CISM, or GIAC certification is desired
- Prior Big 4, advisory or system integrator experience
- Ability to identify and resolve complex issues and develop innovative solutions (advisory skills) for the client's business and technology goals
- Working knowledge of relational database management systems such as Oracle, Sybase, and MS SQL Server
- Systems administration experience
- Working knowledge of MS IIS, Apache and Tomcat, WebLogic, or JBoss application servers
- Working knowledge of one or more directories such as Active Directory, IBM Tivoli Directory Server, Oracle Directory Server or Novell eDirectory