Info Risk Analyst

Chase Card Services Information Services performs technical risk reviews of over 800 third parties, which fall into the category of Outside Service Providers (OSPs), Partners and Vendors. These organizations are both domestic and offshore and cover a wide variety of business needs and services. In order to satisfy our regulatory obligations and duties we have developed a risk-based program, which is applied to each third party agent and organization. This role is required to implement the third party review process and conduct reviews and site visits. The position reports to the Card Services Information Risk Management workgroup. Responsibilities Perform technical risk reviews of third parties Schedule reviews and site visits with third party operations on a timely basis Carry out the review process and on-site reviews Report findings to Card services stakeholders within after completion of the visit. Facilitate with the development of an Action Plan for the remediation of identified findings between OSP/Partner and LoB relationship manager Monitor and verify adherence to Action Plan for the successful remediation of findings. Present reports to the Directors of Security for the LOB and to senior management.. Facilitate cross-enterprise information risk management, issue resolution and cross discipline issue resolution Develop third party risk management guidelines for Card Services Educate Vendor and Partner Relationship Management on Third Party Review (OSP) Process Provide consulting and operational support to cross functional security activities and project teams Manage multiple projects simultaneously with minimal supervision. Advise management on specific technologies that enable secure business growth and develop our relationships with partners and vendors REQUIREMENTS


Excellent communications skills, both written and verbal - High level of intellectual abilty coupled with an analytical mind and tenacious approach Ability to work in a highly matrixed organization Technical knowledge and experience is an advantage Strong negotiating skills: comfortable debating issues with senior decision makers and pushing back where necessary Must be able to work collaboratively with other departments to advocate information security solutions Must possess a high degree of initiative, motivation, and problem-solving skills. Should have 1-4 years as an information security analyst or consultant Experience with 2 or more varieties of Unix, Windows NT/2000, network services, experience with ethical hacking and vulnerability scanning Other complimentary skills include: working knowledge of firewall and intrusion detection technologies and business knowledge regarding banking and financial services Experience in application development methodologies and experience with project management life cycle Experience in network architecture and infrastructure Working knowledge of perimeter security and remote access technologies and considerations Understanding of Disaster Recovery and Business Continuity planning concepts Operational Risk experience and understanding Audit experience and certifications are preferable B.S. Degree required in Computer Science, Information Technology preferable CISSP, CISA, SANS GIAC, or relevant security cert preferable