Cybersecurity Consultant (Internal Audit Facilitator)

Fidelity TalentSource is your destination for discovering your next temporary role at Fidelity Investments! We are currently sourcing for a Sr. Cybersecurity Consultant (Regulatory & Audit) to work in Fidelity's Enterprise Cybersecurity division in Boston, MA!

The Team

The Enterprise Cybersecurity (ECS) Regulatory & Audit team helps ECS and corporate partners manage firm-wide cybersecurity risk by providing key support services. As part of Cyber Regulatory & Audit, the ECS Internal Audit Engagement (IAE) team supports 25-30 internal audits annually. IAE seeks to reduce cyber risk through improved engagement and partnership with ECS Product Areas and Audit to ensure alignment, transparency, and efficiency throughout pre-audit, active audit, and post-audit efforts.

The Role

The ECS Internal Audit Engagement (IAE) team is seeking a hard-working and expert cybersecurity risk professional to support and partner with ECS Product Areas and Fidelity Corporate Audit. The role requires steadfast collaboration throughout the three phases of audit engagement: pre-audit (roadmap alignment, pre-audit control risk gap assessments, trend/theme analysis), active audit (risk quantification, drafting action plans, facilitating risk acceptances), and post-audit (action plan closure, reporting and metrics).

The Expertise and Skills You Bring

• Proven Risk Management and Mitigation experience
• Strong Risk, Process, Cyber Threat Analysis, and Control Gap Assessment skill
• Broad knowledge of cybersecurity threats and tactics
• Understanding of NIST Cybersecurity Framework standards and practices, COBIT 5
• Knowledge of Operations & Technology (identity & access management; physical/personnel security; security ops assessments), Information Risk Management (vendor risk management; cloud computer security; data management), Software Development Process and application security.
• Understanding of FAIR (Factor Analysis of Information Risk) cyber risk framework
• Familiarity with Archer GRC, Jira, and ServiceNow

General Business Skills

• Experience working as corporate/internal auditor or working with corporate audit function
• Analyst mentality to deep dive into audit findings to understand and communicate risks and appropriate responses
• Highly motivated, self-directed, independent problem solver with attention to detail.

Responsibilities

• Partner with internal teams to identify ECS control gaps
• Partner with Audit and ECS teams to confirm reported audit issues and perform FAIR quantitative risk assessments
• Drafting responses (Action Plans) to address valid audit observations
• Manage ECS Product Areas progress toward timely completion of action plans
• Find opportunities to improve team processes to better support ECS Product Areas
• Manage ECS Risk Acceptances
• Maintain and make use of metrics that support various reports and critical meetings
• Partner w/ ECS Product Areas to gain in-depth understanding of roadmaps, backlogs, etc.

Education and Experience

• Bachelor's degree (or equivalent experience) in technology, computer science, or engineering strongly preferred
• 5+ years' experience in cybersecurity risk management, technology operations, system analysis, and/or project management
• Certification a plus: CISSP (Information Systems Security Professional), CEH (Certified Ethical Hacker), CISA (Certified Information Systems Auditor)

Dynamic Working

At Fidelity TalentSource, our goal is for most people to work flexibly in a way that balances both personal and business needs with time onsite and offsite through what we call "Dynamic Working." Most associates will have a hybrid schedule with a requirement to work onsite at a Fidelity location for at least one week, 5 consecutive days, every four weeks. These requirements are subject to change.