The candidate will assist the Head of Risk and Compliance in performing analytical work on Risk Posture and appetite, providing insights into current threats and the risk landscape. Additionally, the role includes analyzing existing risk mitigation strategies and technology controls, communicating their efficacy to the Manager, and suggesting improvements.
Location: UK, Windsor Hybrid (Talk to us about flexible working)
The day to day:
1. Assist in implementing the Technology Risk and Controls framework, ensuring timely assessment and treatment of security risks.
2. Ensure Technology risks are either mitigated or accepted in accordance with the risk appetite.
3. Collaborate with IT teams to identify and assess Technology risks, including Cyber and InfoSec risks.
4. Conduct periodic Technology risk assessments of key services, third parties, and regulatory commitments, and monitor remediation plans.
5. Assess and classify services based on their Confidentiality, Integrity, and Availability.
6. Use the output from Technology risk assessments to identify control gaps and weaknesses, providing strategic direction to improve control efficacy.
7. Work with IT/OT teams to understand key Technology risks and agree on actions to mitigate or monitor and enhance controls.
8. Produce quarterly IT Risk submissions for business units and collaborate with Group-level risk functions on Technology risk.
9. Inform senior leadership of risks and recommendations in non-technical terms, considering cost/benefit, to ensure the security of Information Systems.
Preferred active certification from ISACA in one of the following domains:
* Certified Information Systems Auditor (CISA)
* Certified Information Security Manager (CISM)
Required skills and knowledge:
* Strong knowledge of Technology risk and control assessment methods.
* Proficient in Information Security technologies, such as identity and access management, encryption, and multi-factor authentication.
* Understanding of power utilities, retail energy, and oil & gas industry trends and emerging threats is useful but not essential.
* Ability to leverage external networks to understand emerging Cyber Security threats and events.
* Knowledge of regulatory policies, standards, procedures, and controls (e.g., COBIT, COSO, NIST, ISO27xx).
* Ability to understand business visions and strategy, anticipate associated risks from an IT perspective, and act as a trusted Technology risk advisor to the business.
Join us, be part of more. We're more than an energy company. We're a family of brands revolutionising how we power the planet. We're energisers, one team of 21,000 colleagues committed to creating a greener, fairer future by transforming the energy system away from fossil fuels. We are dedicated to igniting positive change in our communities. Here, you can find more purpose, passion, and potential. That's why working here is #MoreThanACareer. We do energy differently — we make it, store it, move it, sell it, and mend it.
Role overview: The successful candidate will join the British Gas Energy (BGE) Technology Team, focusing on managing Technology Risk as the first line of defence. This role involves facilitating interactions between the Digital Technology Services team and BGE Technology, working collaboratively to identify and manage Technology risks to protect Centrica's customers, data, services, and systems.
#J-18808-Ljbffr