The role sits within KPMG UK’s Information Security Function and provides Security Risk Assessment services to KPMG LLP.
The post holder will report to the Risk Assessment Practice Lead who reports to the Director of Information Assurance.
The postholder will be responsible for working with teams across KPMG LLP to assess risk and determine remediation actions to deliver our products, services and platforms securely.
Key Stakeholders include:
Chief Information Security Officer, Head of Information Assurance, and Head of Security Operations
Business and functional managers across the firm including Project Managers, BISOs (Business Information Security Officers), Procurement, and Supplier Managers
Chief Information Officer, and the IT Service Provider community in the firm
Senior Managers, Directors, and Partners from across the UK firm, KPMG Global, and other KPMG member firms who act as Information/Application/Product Owners
Key Responsibilities:
- Information risk assessment
- Support the information risk assessment capability and team
- Support the delivery of a highly quality and timely information risk assessment (including Business Impact Assessment) service to the firm
- Support the requirements of the firm’s information risk management framework, to ensure a consistent and structured approach to information risk management is taken across the firm
- Provide consulting advice to project managers and other stakeholders on how best to implement the firm’s information security policies
- Support the firm’s mission to build client trust and confidence with regard to information security generally and information risk assessment specifically
- Stay abreast of industry best practice in relation to information risk assessment, and information technologies.
Policy
- Support the development of the UK firm’s information security policies
- Promote good information security practice and standards across the firm’s Risk management
- Proactively foster an environment that drives appropriate information risk control behaviour, including early anticipation, identification and mitigation of information risk, escalating issues in line with the Information Risk Management Framework.
- Support the on-going development and maintenance of the firm’s Information Risk Management Framework, including its supporting methodologies, processes and artefacts.
Awareness and collaboration
- Establish strong relationships with business and functional teams
- Establish effective relationships with IT service providers and other relevant stakeholders
- Build on and preserve the firm’s reputation with clients, with regard to information security