Job Description

“I can succeed as an IT Risk and Security Analyst at Capital Group.”

As a Risk and Security Analyst on the Security and Risk Management team, you’ll join a team focused on the implementation of an effective technology and security risk management framework that partners with various lines of defense and stakeholders in the organization. In this role you will be an integral component of the technology and security risk management framework. You will be responsible for ensuring that risks within Capital Group’s technology environment are identified, assessed, reported, and the set of controls utilized to mitigate those risks are continuously validated. You will assist with performing and continuously maturing the identification, assessment, and reporting of security risks for technology systems and resources. You will lead and/or assist with Information Security regulatory exams and attestations. We will leverage your expertise to lead and/or assist with the facilitation and response for third-party requests for technology or information security-related information (RFI). Lastly, you will collaborate with various process owners and stakeholders, including other risk management teams across CG, and assist with the continuous improvement and development of the group.

“I am the person Capital Group is looking for.”

• You have 5 years of IT risk management, internal control, and/or technology risk consulting experience; 2-5 years of applied data science, statistics, and/or analytics experience a plus
• You have proven experience utilizing industry risk management and security assessment frameworks (e.g. FAIR, NIST, ISO2700x, CAIQ, COBIT, COSO, CISQ, CIS Critical Security Controls, Shared Assessments, etc) to qualify and quantify risk, and performing control assurance / validation
• You have experience and/or familiarity of IT risk and metric monitoring (e.g. KRI, KPI, and KCI monitoring) and reporting
• You have proven experience with internal controls for core IT technologies and processes (e.g., network systems, operating systems, databases, change control tools and processes, computer systems operations, application and system development, help desk and incident monitoring, information security, data backup, retention, and recovery, IT vendor management, asset management, disaster recovery, etc.)
• You have experience utilizing enterprise Governance, Risk, and Compliance tools to manage and assess IT risk
• You have security, auditing, and/or data science or analytics certifications (CISSP, CISA, CAP, etc.) a plus