Engineer, Information Security GRC

Intercontinental Exchange Holdings, Inc. · London, England, United Kingdom

Financial Services · 10,001+ employees

23 h ago

Mid (2-5 yrs) Full-time United Kingdom

About the role

The role is responsible for maintaining corporate information security policies, conducting risk assessments, and managing the vulnerability program. It also involves producing security metrics and responding to regulator, audit, and customer inquiries.

What they look for

Information Security GRC Security Metrics Policy Management Risk Assessment Vulnerability Management Regulatory Compliance NIST Framework COBIT Technical Writing Vendor Evaluation Systems Administration IP Networking Excel Workflow Automation Scripting CISSP

Requirements

Requires a university degree in Information Security or a related field and at least 3 years of relevant experience. Proficiency in cybersecurity frameworks like NIST or COBIT and experience with GRC platforms is expected.

Full description

Job Description

Job Purpose

The Engineer, Information Security GRC is part of a team responsible for the global Information Security program. The role would gain exposure to the full suite of businesses and products which underpin the Parent Intercontinental Exchange (ICE) company.

Information Security (“IS”) is charged with:

Preventing impactful cybersecurity and physical security incidents,

maintaining a reputation with customers, regulators, and key stakeholders as running a best-in-class cybersecurity and physical security program, and

avoiding negative impact to business agility and growth from cybersecurity and physical security policies and controls.

Governance, Risk, and Compliance maintain said policies, ensure controls are operating effectively via assessment and attestation, and own the vulnerability management program to identify and correct any problems within.

Responsibilities

Security Metrics – Uses automated and manual processes to produce regular reports communicating the status of the Information Security program

Policies and Procedures – Maintains corporate Information Security policies and departmental procedures and maps them to relevant control standards

Regulator, Audit, and Customer Inquiries – Organizes and updates departmental documentation and responds to inquiries in an organized and repeatable fashion

Recertification – Operates periodic processes to ensure hire, transfer, and termination protocols are complied with and regular access reviews are conducted

Security Awareness – Builds and maintains company awareness and education programs

Risk Assessment – Builds and operates the company platform to document, measure, and report assessments, risks, controls, findings, and remediation activity

Knowledge and Experience

University degree in Information Security, Engineering, MIS, CIS, or related discipline

3+ years of relevant work experience

Experience in Cybersecurity Framework (such as NIST, COBIT)

Experience with Systems Administration and/or IP Networking is a plus

Experience with Regulatory Compliance

Experience in an exchange, trading facility, or financial services a plus

Experience in Customer communication and Vendor evaluation

Experience with senior management and board metrics generation and communication

Advanced certifications (for example, the CISSP)

Advanced technical writing and/or communication education and experience

Specific Technologies:

Excel, Workflow automation tools, Data collection, normalization, indexing, correlation, and visualization

Scripting, regular expressions, string-parsing, light SDLC, and project management

NIST Cyber Security Framework, CIS, and GRC Platforms