About CLS:
CLS is the trusted party at the centre of the global FX ecosystem. Utilized by thousands of counterparties, CLS makes FX safer, smoother and more cost effective. Trillions of dollars’ worth of currency flows through our systems each day.
Created by the market for the market, our unrivalled global settlement infrastructure reduces systemic risk and provides standardization for participants in many of the world’s most actively traded currencies. We deliver huge efficiencies and savings for our clients: in fact, our approach to multilateral netting shrinks funding requirements by over 96% on average, so clients can put their capital and resources to better use.
CLS products are designed to enable clients to manage risk most effectively across the full FX lifecycle – whether through more efficient processing tools or market intelligence derived from the largest single source of FX executed data available to the market.
Our ambition to make a positive difference starts with our people. Our values – Protect, Improve, Grow – underpin everything that we do at CLS and define and shape a supportive and inclusive working environment in which everyone is encouraged to be open and forward-thinking.
Head of IT Security Risk Management
Job Details
Description
Job purpose
The Head of IT Security Risk management role is an opportunity to actively lead the management of security risk within a systemically important Financial Market Infrastructure. Evolving the security posture across the enterprise. Finding a balance between risks, order, control, innovation, and high-quality performance to maximize their delivery, ensure effective protection and mitigation of security risks.
The candidate will need to be an astute information security professional with excellent communication skills, able to assess the security landscape, identify challenges to be addressed and methods to resolve.
You will be required to own the Security Policy, Procedure and Standards on behalf of the CISO; ensuring that security policy remains at pace with industry regulation and technology advances in line with the overall risk appetite of the business, whilst remaining at pace with Business, Technology and Security strategies.
Driving Security leadership in the interlock of security policy across all Security functions and the wider organization, whilst providing effective interlock across the 3 Lines of Defense, proactively identifying opportunities to address emerging risks and ensure appropriate Security Awareness across the business. Continually assessing interlocks and the relationship to ensure focus is maintained on the right risk priorities.
The role is required to own Security Risk Management, defining, owning, and maintaining the governance of security risk management. Providing a full construct of all security risk and control assessments. Maintaining an inventory of security controls aligned to business criticality, with continuous evaluation of control design effectiveness and operational effectiveness. The Head of IT Security Risk is accountable for ensuring all evaluation is executed and performed by the 1st Line and will be accountable for reporting performance across the organization and critical providers in the effectiveness of security controls in the management and mitigation of security risk.
Talented at forming business relationships with key stakeholders and vendors to remove barriers and enable collaboration and effective delivery. Developing open relationships with teams and continually improving delivery and structure against Security Policy.
As Security Engagement lead, you will be the primary interface with Internal Audit for 1st Line Security, you will provide the conduit for the engagement on audit scope and coordination for the Security function. You will be required to participate in many aspects of audit activities, including risk assessments, planning, testing, control evaluation, documentation, report drafting and follow-up/verification of issue closure. This engagement will require close interlock and working with the Head of Technology Risk and Control, where much of the final 1st Line Technology validation of issues and corrective action plans will be completed ahead of submission to Internal Audit.
The aspect of engagement will focus on creating and demonstrating a strong partnership with Compliance, Technology teams and Vendors, ensuring execution against corporate objectives is achieved through effective collaboration and that the Security Strategy is executed in-line with the Technology Strategy.
Essential Function / major duties and responsibilities of the job
- Identify the need for new policies or modification to existing policies
- Support the development, review and approval of information security policies
- Identify need for new standards or modification to existing guidelines
- Support the development, review and approval of information security guidelines
- Identify the need for new procedures or modification to existing procedures
- Support the development, review and approval of information security procedures
- Support the management of policy exceptions (dispensations)
- Support the management of procedure exceptions
- Own security risk management construct, governance, design, implementation and execution of security risk assessments and control testing
- Own validation and management of security control inventory, evaluating both design effectiveness and operational effectiveness across CLS and critical vendors
- Engage across the 3 Lines of Defense, manage appropriate interlock on expectations and coordination for validation exercises and general engagement
Knowledge, skills and abilities / competencies required for successful job performance
Knowledge
- Advanced knowledge of business processes for supported business groups
- Knowledge of security methodologies, policies, standards and best practices
- Knowledgeable of best practices in information technology governance and regulatory landscape for financial institutions
- Proficiency with administrative tasks including: training, reporting and compliance
- Significant experience in a large and complex business environment
- In-depth knowledge of security frameworks (eg, ISO 27000, NIST, FFIEC, etc)
- Advanced knowledge of information technology systems, infrastructure and operations
- Advanced working knowledge of information systems and operations systems for supported business groups
Skills
- Strong in the use of Microsoft Office software
- Ability to meet expected delivery dates and the tasks necessary to achieve objectives
- Strong ability to analyze data using Excel for reporting and data mining purposes
- Ability to interact with staff at all levels
- Excellent writing and speaking skills
- Strong people skills
- Must be a self-starter and able to manage the investigations function with minimal supervision
- Advanced experience with data visualization concepts and tools
- Advanced computer skills and conversance in information technology issues
- Ability to effectively lead, organize, and supervise
- Ability to work directly with senior level management
Experience
- Evidence of working within Security governance risk and control environment preferred
- Evidence of working in the Financial Service Industry preferred
Education
- Bachelor’s Degree in Engineering, Business Administration or Computer Science preferred
Our commitment to employees:
At CLS, we celebrate diversity and consider this to be one of our strongest assets. We are committed to fostering an environment in which everyone feels comfortable to be who they are, and inclusion is valued. All employees have access to our inclusive benefits, including:
- Holiday - UK/Asia: 25 holiday days and 3 ‘life days’ (in addition to bank holidays). US: 23 holiday days.
- 2 paid volunteer days so that you can actively support causes within your community that are important to you.
- Generous parental leave policies to ensure you can enjoy valuable time with your family.
- Parental transition coaching programmes and support services.
- Wellbeing and mental health support resources to ensure you are looking after yourself, and able to support others.
- Affinity Groups (including our Women’s Forum, Black Employee Network and Pride Network) in support of our organisational commitment to embrace and always be learning more about DE&I.
- Hybrid working to promote a healthy work/life balance, enabling employees to work collaboratively in the office when needed and work from home when they don’t.
- Active support of flexible working for all employees where possible.
- Monthly ‘Heads Down Days’ with no meetings across the whole company.
- Generous non-contributory pension provision for UK/Asia employees, and 401K match from CLS for US employees.
- Private medical insurance and dental coverage.
- Social events that give you opportunities to meet new people and broaden your network across the organisation.
- Annual flu vaccinations.
- Discounts and savings and cashback across a wide range of categories including health and retail for UK employees.
- Discounted Gym membership – Complete Body Gym Discount/Sweat equity program for US employees.
- All employees have access to Discover – our comprehensive learning platform with 1000+ courses from LinkedIn Learning.
- Access to frequent development sessions on a number of topics to help you be successful and develop your career at CLS.
