Third Party Risk Assessor

• 6-8 years of experience in information security with an emphasis on risk assessment and/or risk management
• End-to end implementation of ISO 27001 risk management framework 
• Demonstrated ISO 27001 or other standard audit framework skillset in several information security domains - Mandatory
• Experience conducting successful information security risk assessments –Mandatory requirement
• Experience conducting successful third party information security risk assessments –Preferred
• Demonstrated understanding & functional knowledge of technical domains of risk assessments to include at a minimum

Analyst will be responsible for conducting end to end information security risk assessments to identify, rank, document and ensure treatment of risks in a timely manner 

• Conduct risk assessments to identify, assess, rank, and monitor information security risks for Sony group third parties
• Conduct risk assessments to identify, assess, rank, and monitor information security risks to Sony group internal assets
• Ensure risk recommendations are made and have action plans documented in the enterprise risk management tool
• Have regular meetings with internal & external stakeholders to ensure risk recommendations are tracked, updated and eventually closed
• Keep Sony management updated on the status of risk assessments, treatment, and closure 
• Advise and make recommendations regarding appropriate personnel, physical, and technical security controls required for mitigating identified security risks
• Act as an information security advisor to SIE business and technology groups