Information Security Risk Analyst

About the role

KPMG Jamaica's delivery center, KPMG Jamaica Extended Support Services (KJESS), operates from Kingston and provides support to its member firm KPMG United States. As an Information Security Risk Analyst, you will liaise with IT and other business representatives so that project pipelines are understood and reflected in IT Risk & Security resource planning. You will also take part in skills development for information security personnel, continuously improve security aspects of operating processes, and carry out periodic information security risk assessments of technology-enabled projects.

Key responsibilities

• Perform information security risk assessments of technology-enabled projects against industry-standard or firm-specific control frameworks
• Conduct vendor reviews, define security requirements, facilitate security testing and support management of residual risk
• Use knowledge of application architecture, design, development and secure coding to identify security findings and communicate risks and remediation
• Advise project teams on compensating controls where security requirements cannot be met
• Act as main contact between IT project teams and IT Security to coordinate security resources and support project timelines
• Review evidence submitted to close corrective-action plans and assess whether it meets control objectives
• Liaise with IT and business representatives to support resource planning and contribute to skills development and continuous improvement of security practices

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology or a related field
• At least three years of relevant experience, with recent experience in information security assessment or compliance
• Knowledge of security principles, IT security controls and related technologies and products
• Familiarity with frameworks such as NIST 800-53, NIST 800-171, NIST 800-66, CMMC, NIST Framework, ISO, HITRUST and/or PCIC
• CSSP or CISA certification preferred

Required skills

• Good verbal and written communication, problem-solving, analytical and independent judgement skills
• Project management skills, attention to detail and ability to manage multiple priorities and meet deadlines
• Proficiency with Microsoft 365 applications: Word, Excel, PowerPoint, Outlook, Teams and SharePoint

Work arrangement is hybrid: at least five days per month in the office, with possible extended hours or work on public holidays. The role is paperless and uses information systems throughout the day, and employees are expected to use KPMG-approved generative AI tools.