DirectorofITSecurity&RiskManagement

Lead global information security program

Develop forward-looking security strategy

Serve as trusted advisor

Establish security operating model

Manage information security budget

Plan program resources

Manage program roadmap

Design cybersecurity governance framework

Maintain cybersecurity governance framework

Develop security policies

Implement security policies

Maintain security policies

Develop security standards

Implement security standards

Maintain security standards

Develop security procedures

Implement security procedures

Maintain security procedures

Develop security guidelines

Implement security guidelines

Maintain security guidelines

Create risk-based control framework

Manage risk-based control framework

Support firm-wide risk assessments

Advise leaders on risk mitigation

Oversee incident identification

Oversee incident detection

Oversee incident response

Oversee incident management

Oversee incident recovery

Lead incident response plan development

Lead incident response plan maintenance

Lead incident response plan testing

Monitor external threat environment

Advise stakeholders on threats

Advise stakeholders on vulnerabilities

Advise stakeholders on mitigation actions

Ensure business-critical services resilience

Ensure services recoverability

Ensure security controls effectiveness

Embed security into projects

Embed security into system implementations

Embed security into operational processes

Embed security into technology change initiatives

Evaluate security technologies

Implement security technologies

Improve operational maturity

Establish baseline controls

Support asset inventories development

Support asset inventories maintenance

Partner with Procurement on contracts

Partner with General Counsel on contracts

Ensure security provisions in contracts

Ensure data protection in contracts

Support client security assessments

Support outside counsel guidelines

Support security due diligence requests

Define standards for client expectations

Maintain standards for client expectations

Define controls for client expectations

Maintain controls for client expectations

Define assurance practices for client expectations

Maintain assurance practices for client expectations

Build relationships with external peers

Build relationships with external partners

Build relationships with external vendors

Build relationships with industry groups

Lead security awareness program

Lead security training program

Establish security metrics

Establish security reporting

Measure program effectiveness

Identify security trends

Support decision-making

Recruit information security professionals

Develop information security professionals

Retain information security professionals

Foster accountability culture

Foster collaboration culture

Foster continuous improvement culture