Reports to Chief Technology Officer

Senior Manager of Information Security Overview:

The Sr. Manager of Information Security will serve as the lead for all InfoSec policies and management of external auditors to ensure compliance with its private industry and state/ national regulations. This person should be able to achieve and execute strategy and take an “as is” picture and deliver a cutting edge assessment of what needs to be done. As a result, the Sr. Manager will need to possess a broad and deep range of technical and functional capabilities as it relates to InfoSec.

You will provide the “big picture” direction and roadmaps to where the function is going overall. The Sr. Manager will be responsible for establishing preventive controls, solutions and programs, including security and risk management reporting, metrics, and the overall enterprise security posture across the Company.

There is a need to create greater visibility on enterprise security related priorities, optimize and accelerate its vendor management programs, and other InfoSec policies across the organization. The Sr. Manager will also take charge of Enova’s policies around response to disasters and providing materials to executives and the Board of Directors on these initiatives.

Responsibilities:

SOX ITGCs

• Working closely with Internal Audit, ensure that Enova’s IT General Controls are properly designed, focused in scope, and met without deficiencies.

3rd Party Vendor Reviews

• The Information Security team is responsible for the IT risk assessment of all vendors who do business with Enova. This includes third-party data providers, marketing and prospecting services, and software used internally. Enova reviews more than 200 vendors annually so the review process must both protect information and be efficient to support the business. Your role will be to review the process and optimize it, as well as ensuring clear communication to stakeholders on status.

Infrastructure & Data Security

• Enova has established strong perimeter defenses for its websites and externally-facing applications. The opportunity internally is around three things: awareness of threats and training; enhancing the security practices around software development; data-loss prevention programs for the callcenters.
• -Wide Enterprise Security Risk Program
• Formulate a cohesive risk management framework that can produce a Rapid Risk Assessment (RRA), on any project at any stage, to help level set the risks associated with any endeavor. Establish the ability to reproduce relatable vulnerabilities to risk and track vulnerability remediation and they can track threat actor actions against the enterprise.

Security and Compliance Audits and Certifications

• The Sr. Manager will be responsible for directing and managing the security aspects of Enova’s PCI, EU Privacy, DR, and other assessments and certifications.

Establish and Publish Security KPIs

• There is a need to establish enterprise security KPI’s and publish an organization-wide enterprise security risk management program for transparency and accountability and to create greater visibility on enterprise security related priorities, active efforts and backlogs.

Additional Responsibilities:

• Partners with other leaders to identify acceptable levels of risk, and establish roles and responsibilities with regard to information classification and protection
• Communicates and has visible presence across the organization by sharing information clearly, openly and effectively
• Provide strategic security guidance for all projects and partnerships
• Develop and manage an effective security monitoring and incident response processes and service
• Liaise between the Infrastructure, Software Engineering, Legal and Compliance teams as required
• Direct and manage the enterprise security risk assessment process, including reporting and oversight of remediation efforts to address negative findings
• Develop business-relevant metrics to measure the efficiency and effectiveness of security programs, manage the appropriate resource allocation and continuously increase the maturity of the security programs

Qualifications:

• Minimum of eight to ten years experience in a combination of technology-focused risk management, information/infrastructure security, application security and security positions
• Excellent written and verbal communication skills; interpersonal and collaborative skills; and the ability to communicate security and risk-related concepts to technical and nontechnical audiences
• Ability to influence opinion and direction through substantiated and qualified positions stemming from robust and diverse experience
• Must thrive in a dynamic, fast-paced and fluid organization where priorities shift in response to changing business needs
• Works energetically, highly engaged, transparent, decisive, and produces measurable and superior results
• Flexibility and adaptability in approach, designing the right solution for the situation
• Knowledge of best practice trends and developments in the areas of security and risk management
• Maintains an executive temperament under pressure and stress and facing ambiguity
• Degree in Computer Science, Information Management or other technology-related field, or equivalent work- or education-related experience
• Professional certification, such as a CISSP, CISM, CISA or other information security credentials, is preferred