Job Description

Job Title: Information Security Risk and Compliance Senior Analyst

Department: Information Technology

Location: Red Roof

Pay Band: Sr. Professional

Job Summary:  The Information Security Risk & Compliance Sr. Analyst is responsible for leading and supporting Wawa's information security risk management and compliance activities to ensure that information assets and associated information systems are adequately protected in the digital ecosystem in which Wawa operates.

This role independently manages key elements of Wawa's technology risk management process, including maintenance of the Information Security Risk Register, evaluation and documentation of risk acceptance requests, risk reporting, security control assessments and follow-up on risk treatment and remediation activities. The role communicates risk conclusions and required decisions to technology, business and leadership stakeholders.

This role is heavily involved in Wawa's Payment Card Industry Data Security Standard (PCI DSS) compliance program, including scoping, evidence collection, control validation, assessor support and remediation tracking. Depending on experience, the Sr. Analyst may lead portions of the annual PCI assessment. Prior PCI DSS experience is preferred.

Principal Duties:

• Maintain the Information Security Risk Register and ensure risks are clearly documented, assigned to accountable owners, supported by appropriate treatment plans and tracked through closure or formal acceptance.

• Lead technology and information security risk assessments for new initiatives, material changes, existing services and identified control gaps.

• Evaluate and document risk scenarios, affected assets, threats, control weaknesses, likelihood, business impact and residual risk using Wawa's approved risk methodology.

• Review risk acceptance requests for completeness, evidence quality, appropriate ownership and alignment with Wawa's risk management requirements. Communicate recommendations and required decisions to leadership.

• Develop and deliver risk reporting for technology, business and leadership stakeholders, including risk exposure, trends, aging, ownership, remediation status and decisions required.

• Monitor open risks, exceptions and remediation commitments. Challenge insufficient treatment plans and escalate overdue or materially changing risk exposure.
• Assist in the execution of Wawa's information security program, including meeting PCI compliance requirements, NIST maturity and the ongoing development of the program.
• Assist with cross-department remediation project tasks in multiple workstreams. Act as lead for IT focused remediation projects.
• Develop and update of information security policies and standards.
• Execute the applicable information security management framework controls.
• Identify and document technology related vendor risk and compliance.
• Provide technical support and expertise related to tools used to perform security and vulnerability assessments. Assist with ad-hoc vulnerability compliance reporting and follow up with support partners to ensure all identified vulnerabilities are being addressed.
• Provide support to Information Security Incident Response team during cyber incidents.
• Assist in the development of metrics to measure the effectiveness of the risk and compliance program.
• Validate that information security requirements are built into architectures and new technology projects.
• Maintain and support internal networks between Information Security and information technology. Engage directly with peers as appropriate and necessary.
• Maintain external networks consisting of industry peers, vendors and other relevant parties to address common trends, findings, threats, and cybersecurity risks.
• Act as a technical information security consultant for internal business teams and the IT department to implement and support new and existing technologies.
• Assist in the technical deployment of security solutions that enhance Wawa's information security architecture.
• Maintain foundational knowledge of Payment Card Industry (PCI) Data Security Standard compliance by keeping apprised of changes to the standard, evaluating new systems for impact and supporting annual PCI audit.
• Support audit and assessment process for IT including annual PCI audit, IT general controls review and any other audits or assessments of security and general IT controls.
• Provide technical assistance for technical security services.
• Support IT and business-related projects as required by providing Information Security assistance and guidance on medium impact and complexity initiatives including current technology areas such as cloud services, mobile technology, data analytics, artificial intelligence (AI), bots, IoT (Internet of Things), etc.

Essential Functions:

• Ability to work well individually as well as in a team environment.
• Excellent written and verbal communication skills, interpersonal and collaborative skills.
• Up-to-date knowledge of methodologies and trends in both information security and IT.
• Poise and ability to act calmly and competently in high-pressure, high-stress situations.
• Must be a critical thinker, with strong problem-solving skills.
• Ability to manage one or more projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
• Ability to lead medium internal security technology projects and security remediation projects with limited dependencies on external IT teams.
• High level of personal integrity, as well as the ability to professionally handle confidential matters and show an appropriate level of judgment and maturity.
• High degree of initiative, dependability and ability to work with little supervision while being resilient to change.
• Ability to be on-call 24x7x365 rotation for information security reviews of emergency changes and to support for information security incidents.
• Ability to lead, mentor and influence others.

Basic Requirements:

• Minimum of 5 years of experience in a combination of incident response, information security and IT.
• Demonstrated experience independently performing technology or cybersecurity risk assessments and communicating risk conclusions to technical and nontechnical stakeholders, including leadership.

• Experience maintaining risk registers, evaluating risk acceptance requests, assessing controls, determining residual risk and tracking risk treatment or remediation commitments.
• Experience supporting PCI DSS assessments, scoping, evidence collection, control validation or remediation is preferred. PCI ISA, PCIP or comparable hands-on PCI assessment experience is a plus.
• Degree in technology-related field preferred, or equivalent work- or education-related experience.
• Professional information security certification is required, such as Certified Information Systems Security Professional (CISSP), Certified Ethical Hacking (CEH), GIAC Information Security Professional (GISP), or other similar credentials.
• Advanced knowledge of common information security management frameworks, such as NIST 800-53 and Cybersecurity Framework, ISO/IEC 27001 or Critical Security Controls.
• Moderate knowledge of information security concepts and technologies such as: networking, network segmentation, vulnerability scanners, firewalls, IPS\IDS, network analyzers, data loss prevention, security event management, encryption technologies, proxies, cloud services, mobile devices, etc.

Wawa will provide reasonable accommodation to complete an application upon request, consistent with applicable law. If you require an accommodation, please contact our Associate Service Center at asc@wawa.com.

Wawa, Inc. is an equal opportunity employer. Wawa maintains a work environment in which Associates are treated fairly and with respect and in which discrimination of any kind will not be tolerated. In accordance with federal, state and local laws, we recruit, hire, promote and evaluate all applicants and Associates without regard to race, color, religion, sex, age, national origin, ancestry, familial status, marital status, sexual orientation or preference, gender identity or expression, citizenship status, disability, veteran or military status, genetic information, domestic or sexual violence victim status or any other characteristic protected by applicable law. Unlawful discrimination will not be a factor in any employment decision.