The candidate will be responsible for completing and maintaining 3rd Party Hosting Service Provider reviews, including creating risk assessments, and security test and evaluations. The candidate will also be responsible for supporting the overall security program including security policy, procedures, and standards, assessing the risk of the internal and external IT systems, ensuring Marriott iT documents are compliant with Marriott security policies and procedures, and reviewing documents for accuracy and completeness.
Conduct periodic re-assessment with focus on those with highly sensitive data. Perform application security vulnerability scanning and provide remediation options. Candidate will also assist in managing relationship with Service Providers who are responsible for the delivery of services, managing outcomes and results, and collaborating with stakeholders across IT and business departments to develop strategies for securing company information and assets. Shares responsibility for planning, directing, and coordinating compliance activities pertaining to technology projects for a given business unit. Verifies that project goals are accomplished and in line with business objectives.
Excellent communication skills are required to effectively communicate (verbally and written) across all levels within the organization.
Education and Experience
- Bachelor’s degree in Information Systems or related field or equivalent experience/certification
- 5+ years of information technology leadership experience
- Experience implementing, managing and governing security policies
- Professional and effective communications
- Strongly prefer current information security certification, including Certified in Risk and Information Systems Controls (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)
- A security certification such as GWAPT, GPEN, AWS Associate Architect, AWS Professional Architect, PCI experience.
- Technical knowledge in one or more of the following areas is required: Application Security, Operating System security (UNIX, Windows, Mainframe, etc.) and network security (routers, switches, firewalls)
- Technical leadership experience in an outsourced environment
- Excellent communication skills and problem solving ability
- Experience conducting and maintaining vendor risk assessments
- Experience with reviewing and assessing security controls of Cloud service providers
- Proficient with assessing a multi-tiered system architecture (Web Server, App Server & Database)
- Knowledge of OWASP Top 10 and SANS 25.
- Working knowledge of the infrastructure and application scanning tools (such as Retina, Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, etc.)
- Manual Web Application Testing experience.
- Oversee, evaluate, and support the documentation, and validation processes necessary to assure that associates, information technology systems and business processes meet the organization’s information assurance, security, and privacy requirements. Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations.
- Perform security controls assessments of third party providers – assess security architecture, adherence to the requirements, conduct application scanning and results validation
- Document controls gap analysis and risk assessment of the third party providers
- Review controls exception requests and make risk based approval decision
- Lead, participate or perform various infrastructure compliance initiatives and projects
- Perform Application Security Testing using (Nessus, IBM App Scan, HP Web Inspect, Fortified on Demand, Qualys, Burp, or Retina)
- Conduct and validate finding discovered during the scans
- Monitor compliance to applicable security policies and standards and report related risk issues
- Manage and administer processes and tools that enable the organization to identify, document, and track third party risks and compliance exceptions
- Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures.
- Provide sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocate policy changes and make a case on behalf of the company via a wide range of written and oral work products.
- Oversee the information assurance (IA) program of an information system in or outside the network environment; may include procurement duties.
- Communication – Conveys information and ideas to others in a convincing and engaging manner through a variety of methods.
- Leading Through Vision and Values – Keeps the organization’s vision and values at the forefront of employee decision making and action.
- Managing Change – Initiates and/or manages the change process and energizes it on an ongoing basis, taking steps to remove barriers or accelerate its pace; serves as role model for how to handle change by maintaining composure and performance level under pressure or when experiencing challenges.
- Problem Solving and Decision Making – Identifies and understands issues, problems, and opportunities; obtains and compares information from different sources to draw conclusions, develops and evaluates alternatives and solutions, solves problems, and chooses a course of action.
- Professional Demeanor – Exhibits behavioral styles that convey confidence and command respect from others; makes a good first impression and represents the company in alignment with its values.
- Strategy Development – Develops business plans by exploring and systematically evaluating opportunities with the greatest potential for producing positive results; ensures successful preparation and execution of business plans through effective planning, organizing, and on-going evaluation processes.
- Building a Successful Team – Uses an effective interpersonal style to build a cohesive team; inspires and sustains team cohesion and engagement by focusing the team on its mission and importance to the organization.
- Strategy Execution – Ensures successful execution across of business plans designed to maximize customer satisfaction, profitability, and market share through effective planning, organizing, and on-going evaluation processes.
- Driving for Results – Sets high standards of performance for self and/or others; assumes responsibility for work objectives; initiates, focuses, and monitors the efforts of self and/or others toward the accomplishment goals; proactively takes action and goes beyond what is required.
- Customer Relationships – Develops and sustains relationships based on an understanding of customer/stakeholder needs and actions consistent with the company’s service standards.
- Global Mindset – Supports employees and business partners with diverse styles, abilities, motivations, and/or cultural perspectives; utilizes differences to drive innovation, engagement and enhance business results; and ensures employees are given the opportunity to contribute to their full potential.
- Strategic Partnerships – Develops collaborative relationships with fellow employees and business partners by making them feel valued, appreciated, and included; explores partnership opportunities with other people in and outside the organization; influences and leverages corporate and continental shared services and/or discipline leaders (e.g., HR, Sales & Marketing, Finance, Revenue Management) to achieve objectives; maintains effective external relations with government, business and industry in respective countries; performs effectively as a liaison between locations, disciplines, and corporate to ensure needed resources are received and corporate strategies are understood and executed.
Generating Talent and Organizational Capability
- Developing Others – Supports the development of other’s skills and capabilities so that they can fulfill current or future job/role responsibilities more effectively.
- Organizational Capability – Evaluates and adapts the structure of assignments and work processes to best fit the needs and/or support the goals of an organizational unit.
- Continuous Learning – Actively identifies new areas for learning; regularly creates and takes advantage of learning opportunities; uses newly gained knowledge and skill on the job and learns through their application.
- Technical Acumen – Understanding and utilizing professional skills and knowledge in a specific functional area to conduct and manage everyday business operations and generate innovative solutions to approach function-specific work challenges
- Technical Intelligence: Knowledge and ability to define and apply appropriate technology to enhance business process
- Development Methodologies: Knowledge of general stages of SDLC framework and the application tiers within the development space.
- Information Security: Knowledge of the security considerations relevant within the development space, including industry best practices related to information security
- Business Acumen – Understands and utilizes business information to manage everyday operations and generate innovative solutions to approach business and administrative challenges.
- Basic Competencies – Fundamental competencies required for accomplishing basic work activities.
- Basic Computer Skills – Using basic computer hardware and software (e.g., personal computers, word processing software, Internet browsers, etc.).
- Mathematical Reasoning – The ability to add, subtract, multiply, or divide quickly, correctly, and in a way that allows one to solve work-related issues.
- Oral Comprehension – The ability to listen to and understand information and ideas presented through spoken words and sentences.
- Reading Comprehension – Understanding written sentences and paragraphs in work related documents.
Writing – Communicating effectively in writing as appropriate for the needs of the audience.
Marriott International is an equal opportunity employer committed to hiring a diverse workforce and sustaining an inclusive culture. Marriott International does not discriminate on the basis of disability, veteran status or any other basis protected under federal, state or local laws.