Third Party Risk Assessor

• 6-8 years of experience in information security with an emphasis on risk assessment and/or risk management
• End-to end implementation of ISO 27001 risk management framework
• Demonstrated ISO 27001 or other standard audit framework skillset in several information security domains - Mandatory
• Experience conducting successful information security risk assessments –Mandatory requirement
• Experience conducting successful third party information security risk assessments –Preferred
• Demonstrated understanding & functional knowledge of technical domains of risk assessments to include at a minimum
  
  

Third Party Risk Management,Vendor Risk Management,Information Security,Risk Assessment

Analyst will be responsible for conducting end to end information security risk assessments to identify, rank, document and ensure treatment of risks in a timely manner

• Conduct risk assessments to identify, assess, rank, and monitor information security risks for Sony group third parties
• Conduct risk assessments to identify, assess, rank, and monitor information security risks to Sony group internal assets
• Ensure risk recommendations are made and have action plans documented in the enterprise risk management tool
• Have regular meetings with internal & external stakeholders to ensure risk recommendations are tracked, updated and eventually closed
• Keep Sony management updated on the status of risk assessments, treatment, and closure
• Advise and make recommendations regarding appropriate personnel, physical, and technical security controls required for mitigating identified security risks
• Act as an information security advisor to SIE business and technology groups