• Conduct regular risk assessments to identify potential security threats and vulnerabilities across all organizational systems and operations.
• Develop, implement, and oversee remediation processes to address issues identified via application assessments, audit assessments, key financial application reviews, access control reviews, internal or external audits and/or other assessments.
• Assess the security posture of third-party vendors and manage security risks associated with outsourced services.
• Assist in development of monthly Compliance communications in conjunction with end-user training.
• Ensure adherence to relevant security regulations, TWDC information security policies, security configuration standards, and compliance standards.
• Provide performance reporting related to risk and internal controls effectiveness to key stakeholders.
• Influence prioritization to efficiently and effectively reduce or mitigate security risks timely.
• Provide support for continuous improvement initiatives to mitigate/manage risks while reducing overall compliance costs.
• Partner with functional business areas to analyze and determine the effect to internal control systems for new information technology implementations and proposed process improvement changes.
• Develop and maintain a comprehensive plan to monitor remediation and risk mitigation projects and scope changes, prioritization of scope components.
• Manage, and mature the risk appetite framework for the organization and associated lines of business.
• Be a key partner and contributor to the implementation of enterprise technology and tools, such as a GRC, to support the effective and efficient execution of risk management processes, including automation of processes, where possible.
• You will lead and direct teams of professionals with diverse skills and backgrounds by providing constructive on-the-job feedback/coaching.

Experience and Education

• 8 years of applied work experience in cybersecurity programs, audits, assessments, risk, remediation, or cybersecurity compliance
• Bachelor’s degree in Computer Science, Information Systems, Software, Electrical or Electronics Engineering, or comparable field of study, and/or equivalent work experience
• Relevant security certifications (e.g., CISSP, CISA, CISM)
• Deep understanding of cybersecurity principles and best practices
• Expertise in risk assessment methodologies and frameworks (e.g., NIST RMF)
• Knowledge of security best practices over public cloud such as AWS, Azure and GCP.
• Proven ability to analyze and assess complicated application architectures and workflows to identify risk.
• Familiarity with identity and access management integrations such as Active Directory, Okta, Auth0, SAML, OIDC).
• Knowledge of RESTful web services (client–server application).
• Familiarity with CI/CD principals, tools and services.
• Experience with one or more programming or scripting languages – i.e PowerShell, Python, C#, VB, VBA, Ruby, NodeJS, SQL, etc
• Strong analytical and problem-solving skills
• Excellent communication and presentation skills to convey complex security concepts to non-technical audiences
• Experience with security tools and technologies (e.g., firewalls, intrusion detection/prevention systems, SIEM)
• History of on-time, on-budget delivery of strategic deliverables
• Highly organized and efficient. Proven ability to manage multiple projects at a given time

The hiring range for this position in CA is $138,900 to $186,200 per year. The hiring range for this position in NY and WA is $145,400 to $195,000 per year. The base pay actually offered will take into account internal equity and also may vary depending on the candidate’s geographic region, job-related knowledge, skills, and experience among other factors. A bonus and/or long-term incentive units may be provided as part of the compensation package, in addition to the full range of medical, financial, and/or other benefits, dependent on the level and position offered.

​

#DISNEYTECH

​

#LI-AF2