Senior Manager, Information Security (Risk/Vulnerability management)

Full Time
Bethesda, MD
Areas of Interest: Vulnerability Assessment and Management
report a problem
Overview


A dynamic career ahead of you: Find Your World
We’re building the greatest name in travel, one career at a time.
Marriott International offers you the opportunity to find the hospitality job and career journey that’s right for you. With more than 5700 properties and 30 brands you’ll find us in your neighborhood and in more than 110 countries across the globe. Find Your World™ at Marriott.

Qualifications
JOB SUMMARY

Leads workgroups and/or functions as a technical expert. Assesses and reports on vulnerabilities and remediation efforts across the enterprise.  Guides, reviews and documents internal systems review activities. Designs and rolls out evaluation and improvement processes to assure the inclusion of appropriate elements of quality and compliance with security policy and regulations. Define, implement and manage the Information Vulnerability Management (IVM) Program through the identification and analysis of known and newly found vulnerabilities to determine their operational and security impact. Address vulnerabilities found through remediation recommendations, Information Vulnerability Alerts and Information Vulnerability Bulletins. Performs risk analysis and facilitates risk discussions for cross functional teams.  Provides consultative services to a broad range of internal business leaders on risk and IT security to determine current and target risk levels.  Assist with developing remediation plans.  Monitor progress of agreed upon remediation plans.  This task area requires technical knowledge in computer network theory, IT standards and protocols, as well as an understanding of the lifecycle of cyberspace threats, attack vectors, and methods of exploitation.

 

CANDIDATE PROFILE
Education and Experience
Required:

  • Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification
  • 5+ years of information technology leadership experience
  • Experience implementing, managing or governing security technologies, including vulnerability scanning tools (i.e. Retina, Nessus, etc.)
  • Experience performing risk assessments and analysis within Information Technology
 
Preferred:
  • Current information security certification, including Certified Information Security Manager (CISM), Certified Risk and Information Systems Control (CRISC) or Certified Information Systems Security Professional (CISSP)
  • Technical leadership experience in a sourced environment
  • Project management skills
  • Excellent communication skills and problem solving ability
  • Demonstrated ability to work independently and with others
  • Ability to manage the details and compliance with standards and expectations
  • Technical infrastructure operations, administration, or engineering background
CORE WORK ACTIVITIES
  • Provides technical leadership to the information vulnerability management process, including developing and managing the remediation program 
  • Identify and draft mitigation guidance for vulnerabilities with no vendor- provided remediation
  • Establish communications with vendors for the release of newly identified vulnerabilities to ensure they understand specialized and proprietary asset requirements
  • Analyze publicly disclosed vulnerabilities of vendor software/hardware products and develop the mitigation/remediation orders
  • Compile daily, weekly, monthly and annual vulnerability metrics associated with affected and non-compliant assets
  • Utilize tracking tools/capabilities in a vulnerability management system to review manually uploaded and automated information to report vulnerability mitigation and remediation progress
  • Identify, analyze, and develop mitigation or remediation actions for system and network vulnerabilities
  • Assist with the prioritization of newly identified software/hardware vulnerabilities based upon severity, potential operational impact, exploitation, and other factors to assess risk to Marriott assets
  • Conduct open source research to identify and analyze known and unknown vulnerabilities
  • Analyze known issues with vendor provided fixes and contact the appropriate vendor for a defined and attainable solution
  • Perform planned and ad-hoc infrastructure vulnerability scanning, determine remediation options and track remediation to completion.
  • Evaluate and test hardware, firmware and software for possible impact on system security, and the investigation and resolution of security risk and incidents. Assist with vulnerability exceptions.
  • Initiate and evaluate vulnerability scans for operational readiness and validate if vulnerabilities are false positives based on the Operating system and/or and application configuration.
  • Assess, maintain, and distribute security patch deployment ratings for Microsoft, Linux, Unix, and HPUX patch releases.
  • Work proactively with IT Infrastructure partners with respect to strategic and tactical plans for information security
  • Work proactively with IT Infrastructure partners regarding major system changes to ensure information security standards are addressed early in a project’s life and incorporated into the resulting program
  • Provides technical leadership, oversight, standardization and validation of the effectiveness of the security systems
  • Performs risk assessments using the Factor Analysis of Information Risk methodology
  • Provides guidance and educates the organization in risk management principles and practices
  • Communicates with Subject Matter Experts to determine expected impact and likelihood of loss events
  • Maintain organizational Risk Register
  • Participates in the evaluation and selection of security and risk management services products
  • Supports governance based on best practices and ensures proper alignment to projects and major initiatives
  • Leads analysis of the current environment to detect critical deficiencies and recommends solutions for improvement
  • Leads analysis of technology industry and market trends to determine their potential impact on the infrastructure architecture
  • Promotes the benefits of security services to the organization and educates all on security concepts
Technical Leadership
  • Trains and/or mentors other team members, and peers as appropriate
  • Provides financial input on department or project budgets, capital expenditures or other cost/resource estimates as requested
  • Identifies opportunities to enhance existing processes
IT Governance
  • Follows all defined IT standards and processes (i.e. IT Governance, SM&G, Architecture, etc.), and provides input for improvements to the appropriate process owners as needed
  • Maintains a proper balance between business and operational risk
  • Follows the defined project management standards and processes

MANAGEMENT COMPETENCIES
Leadership

  • Communication - Conveys information and ideas to others in a convincing and engaging manner through a variety of methods.
  • Leading Through Vision and Values - Keeps the organization's vision and values at the forefront of employee decision making and action.
  • Managing Change - Initiates and/or manages the change process and energizes it on an ongoing basis, taking steps to remove barriers or accelerate its pace; serves as role model for how to handle change by maintaining composure and performance level under pressure or when experiencing challenges.
  • Problem Solving and Decision Making - Identifies and understands issues, problems, and opportunities; obtains and compares information from different sources to draw conclusions, develops and evaluates alternatives and solutions, solves problems, and chooses a course of action.
  • Professional Demeanor - Exhibits behavioral styles that convey confidence and command respect from others; makes a good first impression and represents the company in alignment with its values.
  • Strategy Development - Develops business plans by exploring and systematically evaluating opportunities with the greatest potential for producing positive results; ensures successful preparation and execution of business plans through effective planning, organizing, and on-going evaluation processes.
Managing Execution
  • Building a Successful Team - Uses an effective interpersonal style to build a cohesive team; inspires and sustains team cohesion and engagement by focusing the team on its mission and importance to the organization.
  • Strategy Execution – Ensures successful execution across of business plans designed to maximize customer satisfaction, profitability, and market share through effective planning, organizing, and on-going evaluation processes.
  • Driving for Results - Sets high standards of performance for self and/or others; assumes responsibility for work objectives; initiates, focuses, and monitors the efforts of self and/or others toward the accomplishment goals; proactively takes action and goes beyond what is required.
Building Relationships
  • Customer Relationships - Develops and sustains relationships based on an understanding of customer/stakeholder needs and actions consistent with the company’s service standards.
  • Global Mindset - Supports employees and business partners with diverse styles, abilities, motivations, and/or cultural perspectives; utilizes differences to drive innovation, engagement and enhance business results; and ensures employees are given the opportunity to contribute to their full potential.
  • Strategic Partnerships - Develops collaborative relationships with fellow employees and business partners by making them feel valued, appreciated, and included; explores partnership opportunities with other people in and outside the organization; influences and leverages corporate and continental shared services and/or discipline leaders (e.g., HR, Sales & Marketing, Finance, Revenue Management) to achieve objectives; maintains effective external relations with government, business and industry in respective countries; performs effectively as a liaison between locations, disciplines, and corporate to ensure needed resources are received and corporate strategies are understood and executed.

Generating Talent and Organizational Capability

  • Developing Others - Supports the development of other’s skills and capabilities so that they can fulfill current or future job/role responsibilities more effectively.
  • Organizational Capability - Evaluates and adapts the structure of assignments and work processes to best fit the needs and/or support the goals of an organizational unit.
Learning and Applying Professional Expertise
  • Continuous Learning - Actively identifies new areas for learning; regularly creates and takes advantage of learning opportunities; uses newly gained knowledge and skill on the job and learns through their application.
  • Technical Acumen - Understanding and utilizing professional skills and knowledge in a specific functional area to conduct and manage everyday business operations and generate innovative solutions to approach function-specific work challenges
    • Technical Intelligence: Knowledge and ability to define and apply appropriate technology to enhance business process
    • Development Methodologies: Knowledge of general stages of SDLC framework and the application tiers within the development space.
    • Information Security: Knowledge of the security considerations relevant within the development space, including industry best practices related to information security
  • Business Acumen - Understands and utilizes business information to manage everyday operations and generate innovative solutions to approach business and administrative challenges.
  • Basic Competencies - Fundamental competencies required for accomplishing basic work activities.
    • Basic Computer Skills - Using basic computer hardware and software (e.g., personal computers, word processing software, Internet browsers, etc.).
    • Mathematical Reasoning  - The ability to add, subtract, multiply, or divide quickly, correctly, and in a way that allows one to solve work-related issues.
    • Oral Comprehension - The ability to listen to and understand information and ideas presented through spoken words and sentences.
    • Reading Comprehension - Understanding written sentences and paragraphs in work related documents.
    • Writing - Communicating effectively in writing as appropriate for the needs of the audience.
Marriott International is an equal opportunity employer committed to hiring a diverse workforce and sustaining an inclusive culture. Marriott International does not discriminate on the basis of disability, veteran status or any other basis protected under federal, state or local laws.



Share this job:

Marriott International

Find your world.
Marriott International is a leading global lodging company based in Bethesda, Maryland, USA, with more than 4,100 properties in 79 countries and reported revenues of nearly $14 billion in fiscal year 2014. Its heritage can be traced to a root beer stand opened in Washington, D.C., in 1927 by J. Willard and Alice S. Marriott. The company operates and franchises hotels and licenses vacation ownership resorts under 19 brands, including: Marriott Hotels, The Ritz-Carlton, JW Marriott, Bulgari, EDITION, Renaissance, Gaylord Hotels, Autograph Collection, AC Hotels by Marriott, Moxy Hotels, Courtyard, Fairfield Inn & Suites, SpringHill Suites, Residence Inn, TownePlace Suites, Protea Hotels, Delta Hotels and Resorts, Marriott Executive Apartments and Marriott Vacation Club. Marriott has more than 361,000 people working worldwide at managed or franchised properties and corporate offices. Marriott has been consistently recognized as a top employer and for its superior business ethics. The company also manages the award-winning guest loyalty program, Marriott Rewards® and The Ritz-Carlton Rewards® program, which together surpass 49M members. Marriott is consistently recognized as a top employer and for its superior business operations, which it conducts based on five core values: put people first, pursue excellence, embrace change, act with integrity, and serve our world.
rel=0&showinfo=0" frameborder="0" allowfullscreen>
Visit Marriott International's Social Media pages:
Company Industry: Hospitality
Company Type: Public Company
Company Size: 10,001+