Sr. Information Security Compliance Analyst

Description

The company is building a global media and entertainment business around storytelling, with a focus on creators, audiences, technology and scale.

The Global Information and Content Security team covers all US and international brands and divisions. You will work with business units and stakeholders to meet PCI requirements and other cybersecurity regulations and policies.

The PCI program covers online payments such as retail e-commerce, ticketing, direct-to-consumer subscriptions, pay-per-view sports, donations and partner payments, in-app mobile purchases and vendor invoicing. It also covers in-person payments at call centers, museums, retail stores, physical tours, pop-up shops and virtual reality experiences.

The team builds a security culture across the company, provides policies, standards and training, and works with technology partners to assess risk and build controls.

The role is a senior position that validates critical processes and controls end to end, flags risk and non-compliance, and drives compliance initiatives and the compliance program.

Responsibilities

• Lead and support PCI assessments, including audits, risk mitigation and remediation.
• Lead compliance assessments and reviews, test controls for effectiveness, and coach team members to keep reviews thorough and rigorous.
• Test system requirements, data flows and written procedures through testing and observation to confirm controls work as intended.
• Analyze test results to find system and process gaps, and recommend process changes or new controls.
• Track remediation plans for control deficiencies and regulatory or policy gaps, and recommend efficiency improvements.
• Write clear, concise reports on results and recommendations, and work with management to make corrective actions stick.
• Keep project plans, task lists and milestones current, and report risks and status to management on time.
• Maintain the central issues log, audit calendar and other team documents with accuracy.
• Measure key audit and assessment metrics, and help build status updates for your manager.
• Take part in cross-functional teams on regulatory changes, including new system changes that must meet regulatory, security and legal requirements.
• Document all work and findings, and share them with stakeholders through standard processes.
• Organize and lead meetings with stakeholders across the company and around the world.
• Help implement the company's GRC system, policies, standards and processes.
• Track the company's major projects and initiatives so you can plan your work.
• Track the latest security technology and compliance requirements, and propose useful improvements.

Requirements

• A bachelor's degree in computer science, business administration or a related technical field.
• At least 4 years in audit or compliance work in a corporate or consulting role, in a highly technical setting.
• At least 3 years of PCI regulatory assessment or requirements work, with current PCI Qualified Security Assessor (QSA) certification.
• Experience with PCI 4.0 assessment types, including SAQ-A, ROC, SAQ-D, SAQ B-IP and SAQ P2PE.
• Experience remediating vulnerabilities found through PCI ASV scanning.
• Experience testing cloud controls on AWS, Azure and GCP.
• Experience planning certification or action plan roadmaps that balance compliance deliverables, business needs and resources.
• Experience across cross-functional risk, compliance or information security disciplines.
• Subject matter knowledge of PCI, data privacy, SSAE 18, Swift and SOX.
• A relevant certification such as CISA, PCIP, CISM or CISSP.
• Precision and strong attention to detail.
• Strong analytical and problem-solving skills, with sound judgment and healthy skepticism.
• Strong relationship-building skills and the ability to influence courses of action.
• Excellent communication and project management skills, and clear, polished written and visual work.
• The ability to set priorities and deliver across several projects, including under pressure and with shifting priorities.
• The ability to work independently, adapt, and learn from feedback.
• The highest level of integrity, suited to a compliance and ethics role.
• Nice to have: 3+ years of Big 4 experience in a related field.
• Nice to have: 3+ years of experience in media, tech, entertainment, business development or streaming.
• Nice to have: knowledge of and interest in media, entertainment and technology, including key players, growth trends, new media models and industry structure.
• Nice to have: familiarity with streaming and similar products or services.
• Nice to have: experience at a national or global company.
• Nice to have: experience with visualization tools such as Tableau or Power BI.
• Nice to have: comfort working in a highly iterative environment.
• Nice to have: a creative problem solver with sound business judgment, a strong eye for detail, and the ability to turn insights into a clear story while balancing detail and the bigger picture.

Conditions

This is a hybrid role with 3 days a week onsite at the Atlanta office.

The salary range is $89,390.00 to $166,010.00 per year.

Pay depends on factors such as location, market data, internal equity, skills, experience, training, education and performance.

Base pay is one part of total compensation, which may include annual bonuses, short- and long-term incentives and program awards.

Accommodations are available during the application and recruitment process for qualified candidates with disabilities.

The company is an equal opportunity employer.

Benefits

• Health insurance coverage.
• An employee wellness program.
• Life and disability insurance.
• A retirement savings plan.
• Paid holidays, sick time and vacation.