Job Description:

As a Senior Regional Security Governance & Risk Analyst on the Americas Security team, you'll play a pivotal role in maintaining a security governance and risk program that supports our information security management system, certification initiatives, policy implementation, and risk and exception management. You'll collaborate with regional and global stakeholders to coordinate risk assessments, maintain regional inputs to the global security risk register, evaluate control effectiveness, and drive agreed remediation and security improvement actions. You'll also maintain compliance obligations and supporting evidence, helping translate security requirements into practical business processes that protect information confidentiality, integrity, and availability. Led by the Americas Region BISO, our Americas Region Security team is responsible for security initiatives across the Americas Region and supporting dentsu’s clients and brands.

If you're a proactive, detail-oriented professional with a passion for cybersecurity and a desire to make a meaningful impact, we encourage you to apply and be part of our mission to protect what matters most

Responsibilities

• Build positive relationships with regional and global stakeholders, partnering with business, risk, and control owners to embed security governance requirements and progress agreed actions.
• Coordinate risk remediation activities supporting the information security management system, working with action owners to address findings from incidents, root cause analyses, audits, and risk assessments.
• Assess and report on the design and operating effectiveness of security controls, documenting supporting evidence, control gaps, and recommended improvements for risk and control owners.
• Actively contribute to security training initiatives to increase employee awareness
• Coordinate the regional security exception process, documenting business justification, risk assessments, compensating controls, required approvals, and review or expiry dates in line with the defined process.
• Coordinate information security risk assessments using the defined information security risk management process, ensuring relevant stakeholders provide inputs and agreed assessments are completed within established timeframes.
• Assess risks for in-scope platforms across the Americas.
• Maintain regional risk records and their corresponding entries in the global security risk register, keeping risk descriptions, owners, assessments, treatment plans, and status updates accurate and current in coordination with global risk stakeholders.
• Coordinate regional activities supporting security certification initiatives and audits, maintaining assessment schedules, organizing evidence, and tracking findings and agreed corrective actions.
• Maintain the regional security improvement plan, tracking action owners, milestones, and agreed target dates; validate completion evidence and escalate overdue actions or delivery barriers through the appropriate governance channels.
• Partner with business and technology stakeholders to review and improve internal processes and systems, addressing security risks and dependencies identified through business impact assessments and data protection impact assessments to protect information confidentiality, integrity, and availability.
• Define and maintain a regional record of applicable security compliance obligations, mapping each obligation to relevant controls, evidence requirements, and evidence owners to demonstrate alignment.
• Document and regularly review governance, risk assessment, risk treatment, and exception procedures, keeping regional practices aligned
• with the defined global security governance and risk management processes.
• Drive continuous improvement in regional security governance and risk management by identifying recurring control gaps, analyzing risk trends, and recommending practical, risk-based improvements to regional and global stakeholders.

Candidate Profile

• Stakeholder management and interpersonal skills at both a technical and non-technical level.
• Demonstrated experience in information security governance and risk management, including supporting an information security management system and applying knowledge of security practices, technologies, and architectures to business risks.
• Ability to work independently on complex governance and risk activities, prioritize competing demands, and manage assessments and remediation actions through to completion while adapting to changing business conditions.
• Proactive, upbeat and collaborative communication style, with the ability to be direct, tactful, and transparent
• Ability to work effectively as part of a team
• Solid problem-solving skills. Ability to analyze problems and risk from multiple perspectives
• Comfortable with managing uncertainty, ambiguity, and change to make decisions and prioritize tasks
• Practical experience applying information security risk assessment and treatment techniques, maintaining risk registers, and documenting risk decisions and exceptions using a defined risk management process.
• Ability to translate complex technical findings into clear business-risk statements and concise governance reports for technical and non-technical stakeholders, supported by strong communication and organizational skills.
• Is demonstrably self-motivated, pro-active, action orientated to achieve deadlines
• Proactive development of trending knowledge and skills within information security community
• Demonstrated ability to support policy reviews, maintain compliance obligations and evidence mappings, and coordinate risk treatment and exception workflows with relevant stakeholders.
• Desirable qualifications include experience with IT assurance and auditing techniques, an understanding of network architecture and protocols, and an achieved or in-progress information security qualification such as CISSP, CISM, CISA, or CRISC. These are advantageous rather than mandatory.
• Experienced with IT assurance functions and auditing techniques (desirable)
• Understanding of network architecture, protocols and principles (desirable)
• Fluency in Spanish and English is required. Portuguese proficiency is highly desirable.

#LI-CA2

Location:

Brand:

Time Type:

Contract Type: