Specialist, Data Privacy

Role Overview

Information Security and Governance

• Perform information security and IT risk assessments and document results.
• Execute control checks against approved policies, standards, and regulatory requirements.
• Conduct third-party and vendor security assessments and document findings.
• Maintain compliance evidence and security documentation for regulatory and audit requirements.
• Analyze security control effectiveness and report observations through defined channels.

Security Initiatives and Services

• Coordinate with group stakeholders to implement security initiatives and action plans.
• Identify control gaps or implementation issues and escalate them through appropriate management channels.
• Coordinate with shared service providers and monitor compliance with contractual agreements and SLAs.
• Participate in security assessments and audits involving external service providers.

Data Protection and Privacy

• Perform data classification and protection activities under approved data protection requirements.
• Execute controls related to PII and PHI data security.
• Review data handling practices and document privacy compliance observations.
• Support the identification and documentation of data protection risks and incidents.

Identity and Access Governance

• Perform IAM governance activities covering onboarding, offboarding, access reviews, and recertification.
• Review privileged access and MFA controls and document compliance status.
• Maintain access governance records and supporting evidence.

Standard Duties

• Perform security monitoring, vulnerability tracking, compliance checks, control testing, and audit evidence collection.
• Maintain GRC documentation, risk registers, compliance trackers, and remediation status reports.
• Document information security incidents, root causes, corrective actions, and CAPA plans.
• Apply ISMS processes and coordinate operationally with shared services teams.

Requirements

• Subject-matter expertise in information security initiatives within a defined scope.
• Ability to perform information security and IT risk assessments and document results.
• Ability to execute control checks against information security policies, standards, and regulatory requirements.
• Knowledge of data classification, PII and PHI protection, and privacy compliance controls.
• Knowledge of identity and access governance, including access reviews, recertification, privileged access, and MFA controls.
• Ability to maintain compliance evidence, risk registers, GRC documentation, and audit support records.