Associate Director, Cyber Operations (Countermeasures)
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. Must not include Job ID etc. Remove boilerplate, EEO, etc. Must preserve all substantive info.
We need to parse the posting.
Content:
Intro paragraph: "Known for being a great place to work and build a career, KPMG provides audit, ... If you're as passionate about your future as we are, join our team. KPMG is currently seeking an Associate Director, Cyber Operations (Countermeasure) to join our Enterprise Security Services organization."
That's about the role. Could be "About the role" section.
Then "Responsibilities:" followed by a long paragraph with many sentences. Need to split into list items? The instruction: Use - for any list of duties/requirements/benefits, and
for prose. So we need to decide if responsibilities are a list; they are multiple bullet-like sentences separated by semicolons. Likely we should treat each duty as a list item. So we will create
- for each responsibility.
Then "Qualifications:" followed by a block of text with many requirements. Likely also list items.
We also have "Benefits" paragraph: "In addition, KPMG is proud to offer a comprehensive, competitive benefits package..." then details about benefits. So we can have Benefits section with list items.
Pay: There's salary range info: "California Salary Range: $153000 - $297000" plus mention of pay transparency link. So we can include Pay section with that info.
Schedule: Not mentioned explicitly. There's mention of Personal Time Off, holidays, breaks. That's more about benefits/time off, not schedule. No explicit schedule like work hours. So we should not create Schedule section unless there is real specific content. There's mention of "standard work hours" but not specific. Probably not include Schedule.
Skills: Could be derived from qualifications but we have Qualifications section already. Could also have Skills but we might combine. The instruction: prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Qualifications, Benefits, Pay. Possibly also Requirements? The qualifications already cover requirements. The posting has "Qualifications:" heading. We could treat that as Requirements or Qualifications. Since we have both headings possible, we need to decide which to use. The posting says "Qualifications:" then lists experience, education, certifications, etc. That's qualifications. So we can use
Qualifications
. Not need separate Requirements.
Skills: Could be extracted but we already have qualifications covering skills. Might not need separate Skills.
Thus sections: About the role (intro paragraph), Responsibilities (list), Qualifications (list), Benefits (list), Pay (maybe paragraph with salary range and link). Ensure we preserve all substantive info.
We must not include boilerplate like EEO, visa sponsorship details? The visa sponsorship info is substantive: "Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)". That's a requirement about work authorization. Should be included. Where? Could be part of Qualifications or Responsibilities? It's a requirement. We'll include in Qualifications list as an item.
Also the bit about "KPMG LLP and its subsidiaries (“KPMG”) complies with all local/state regulations regarding displaying salary ranges..." is about pay transparency; we can include in Pay section.
Also the benefits details: medical, dental, vision, disability, life insurance, 401(k), personal well-being benefits, PTO, holidays, breaks. Also link to benefits page.
We must not include duplicated lines, cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. The EEO paragraph at end is boilerplate; remove. Also the "No phone calls or agencies please." etc. Remove. Also the Los Angeles County applicants section about criminal history is likely legal boilerplate; remove. Also the "KPMG recruits on a rolling basis..." etc is application instructions; remove. Also the "Follow this link to obtain salary ranges by city outside of CA:" is part of pay transparency; we can keep that link.
Now craft HTML.
We'll start with About the role
then with the intro paragraph (maybe two sentences). Ensure we keep all info: "Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today's most important industries. Our growth is driven by delivering real results for our clients. It's also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it's no wonder we're consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you're as passionate about your future as we are, join our team. KPMG is currently seeking an Associate Director, Cyber Operations (Countermeasure) to join our Enterprise Security Services organization."
That's the about role.
Next Responsibilities: we need to parse the responsibilities block.
Responsibilities text:
"Build and lead anenterprise cybersecurity countermeasures program across the full technologylifecycle; Define the strategy, scope, priorities, funding needs, governance,and measures required to prevent, detect, contain, and reduce exploitableweaknesses across applications, cloud services, infrastructure, endpoints, anddata environmentsOperationalize acountermeasures and multi-cloud security program through repeatable processes,integrated workflows, clear ownership, service-level objectives, risk-basedprioritization, exception management, validation standards, and executivereporting; Maintain reliable coverage, data quality, access governance,lifecycle management, and control-effectiveness monitoringDirect preventive countermeasures throughoutdevelopment and deployment to mitigate attack path and control gap risks, andconvert technical exposure into a solution to buy time to remediate riskEstablish andmaintain interim controls that reduce exploitability and limit business impactwhile infrastructure and application teams correct underlying weaknesses; Define expiration dates, monitoring requirements, escalation paths, andevidence needed to confirm that temporary controls remain effectiveOversee theintegration of GCP and Workbench security tooling integration, automations, andprocesses while keeping current with the latest cybersecurity practices andtechnologiesDevelop operating plans and governance models thatsupport multi-cloud and federated remediation; Define accountability, decisionrights, compensating-control requirements, risk-acceptance criteria, escalationthresholds, and executive metrics that hold distributed teams accountable forsustained exposure reductionAct with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment"
We need to split by semicolons into items. Also note some missing spaces due to OCR: "anenterprise", "technologylifecycle", etc. We should preserve as is but maybe add spaces? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. We should not correct OCR errors? It's ambiguous. Probably we should keep the text exactly as given, but we could add spaces for readability? That would be inventing. Better to keep as is, but the missing spaces may affect readability but it's still the same info. We'll keep the exact strings.
Thus each item:
- Build and lead anenterprise cybersecurity countermeasures program across the full technologylifecycle
- Define the strategy, scope, priorities, funding needs, governance,and measures required to prevent, detect, contain, and reduce exploitableweaknesses across applications, cloud services, infrastructure, endpoints, anddata environments
- Operationalize acountermeasures and multi-cloud security program through repeatable processes,integrated workflows, clear ownership, service-level objectives, risk-basedprioritization, exception management, validation standards, and executivereporting
- Maintain reliable coverage, data quality, access governance,lifecycle management, and control-effectiveness monitoring
- Direct preventive countermeasures throughoutdevelopment and deployment to mitigate attack path and control gap risks, andconvert technical exposure into a solution to buy time to remediate risk
- Establish andmaintain interim controls that reduce exploitability and limit business impactwhile infrastructure and application teams correct underlying weaknesses
- Define expiration dates, monitoring requirements, escalation paths, andevidence needed to confirm that temporary controls remain effective
- Oversee theintegration of GCP and Workbench security tooling integration, automations, andprocesses while keeping current with the latest cybersecurity practices andtechnologies
- Develop operating plans and governance models thatsupport multi-cloud and federated remediation
- Define accountability, decisionrights, compensating-control requirements, risk-acceptance criteria, escalationthresholds, and executive metrics that hold distributed teams accountable forsustained exposure reduction
- Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment
Check if any missing due to line breaks. The original had some line breaks but we treat as semicolons.
Now Qualifications block:
"Minimum eight years of recent experience in security architecture, preferably with a specialization in Google Cloud Platform (GCP) security (data loss prevention and SecOps) and the Wiz product suite (Code, Cloud, Defend,Exposure Management), and security tooling integration; deep technicalexpertise across multiple technical domains, including security incidentresponseBachelor's degree from an accredited college or university is preferred; Minimum of a high school diploma or GED is required; certifications in certified information systems security professional (CISSP) and google professional cloud security engineer are preferredExperience leading and managing information technology (IT) security resources and/or projects with demonstrated ability to define, document, and peer review technical security standards; experience with security related regulatory requirements, such as National Institute of Standards and Technology (NIST), ISO 27001, and Health Insurance Portability and Accountability Act (HIPAA) plans, project estimations and budgetingCapability to influence without authority in a matrixed environment and develop resource plans, project plans, project estimations and budgeting Ability to foster the development of high-performance teams and interface with all levels of the organization; ability to participate in development of resource plans and structures and influence organizational prioritiesExcellent verbal/written communication, collaboration, analytical and presentation skills to lead an environment driven by customer service and teamwork; must be able to set goals and participate in strategic initiatives for a teamApplicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)"
We need to split by semicolons.
Let's parse:
1. Minimum eight years of recent experience in security architecture, preferably with a specialization in Google Cloud Platform (GCP) security (data loss prevention and SecOps) and the Wiz product suite (Code, Cloud, Defend,Exposure Management), and security tooling integration
2. deep technicalexpertise across multiple technical domains, including security incidentresponse
3. Bachelor's degree from an accredited college or university is preferred
4. Minimum of a high school diploma or GED is required
5. certifications in certified information systems security professional (CISSP) and google professional cloud security engineer are preferred
6. Experience leading and managing information technology (IT) security resources and/or projects with demonstrated ability to define, document, and peer review technical security standards
7. experience with security related regulatory requirements, such as National Institute of Standards and Technology
for prose. So we need to decide if responsibilities are a list; they are multiple bullet-like sentences separated by semicolons. Likely we should treat each duty as a list item. So we will create
- for each responsibility.
Then "Qualifications:" followed by a block of text with many requirements. Likely also list items.
We also have "Benefits" paragraph: "In addition, KPMG is proud to offer a comprehensive, competitive benefits package..." then details about benefits. So we can have Benefits section with list items.
Pay: There's salary range info: "California Salary Range: $153000 - $297000" plus mention of pay transparency link. So we can include Pay section with that info.
Schedule: Not mentioned explicitly. There's mention of Personal Time Off, holidays, breaks. That's more about benefits/time off, not schedule. No explicit schedule like work hours. So we should not create Schedule section unless there is real specific content. There's mention of "standard work hours" but not specific. Probably not include Schedule.
Skills: Could be derived from qualifications but we have Qualifications section already. Could also have Skills but we might combine. The instruction: prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Qualifications, Benefits, Pay. Possibly also Requirements? The qualifications already cover requirements. The posting has "Qualifications:" heading. We could treat that as Requirements or Qualifications. Since we have both headings possible, we need to decide which to use. The posting says "Qualifications:" then lists experience, education, certifications, etc. That's qualifications. So we can use
Qualifications
. Not need separate Requirements. Skills: Could be extracted but we already have qualifications covering skills. Might not need separate Skills. Thus sections: About the role (intro paragraph), Responsibilities (list), Qualifications (list), Benefits (list), Pay (maybe paragraph with salary range and link). Ensure we preserve all substantive info. We must not include boilerplate like EEO, visa sponsorship details? The visa sponsorship info is substantive: "Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)". That's a requirement about work authorization. Should be included. Where? Could be part of Qualifications or Responsibilities? It's a requirement. We'll include in Qualifications list as an item. Also the bit about "KPMG LLP and its subsidiaries (“KPMG”) complies with all local/state regulations regarding displaying salary ranges..." is about pay transparency; we can include in Pay section. Also the benefits details: medical, dental, vision, disability, life insurance, 401(k), personal well-being benefits, PTO, holidays, breaks. Also link to benefits page. We must not include duplicated lines, cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. The EEO paragraph at end is boilerplate; remove. Also the "No phone calls or agencies please." etc. Remove. Also the Los Angeles County applicants section about criminal history is likely legal boilerplate; remove. Also the "KPMG recruits on a rolling basis..." etc is application instructions; remove. Also the "Follow this link to obtain salary ranges by city outside of CA:" is part of pay transparency; we can keep that link. Now craft HTML. We'll start withAbout the role
thenwith the intro paragraph (maybe two sentences). Ensure we keep all info: "Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today's most important industries. Our growth is driven by delivering real results for our clients. It's also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it's no wonder we're consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you're as passionate about your future as we are, join our team. KPMG is currently seeking an Associate Director, Cyber Operations (Countermeasure) to join our Enterprise Security Services organization." That's the about role. Next Responsibilities: we need to parse the responsibilities block. Responsibilities text: "Build and lead anenterprise cybersecurity countermeasures program across the full technologylifecycle; Define the strategy, scope, priorities, funding needs, governance,and measures required to prevent, detect, contain, and reduce exploitableweaknesses across applications, cloud services, infrastructure, endpoints, anddata environmentsOperationalize acountermeasures and multi-cloud security program through repeatable processes,integrated workflows, clear ownership, service-level objectives, risk-basedprioritization, exception management, validation standards, and executivereporting; Maintain reliable coverage, data quality, access governance,lifecycle management, and control-effectiveness monitoringDirect preventive countermeasures throughoutdevelopment and deployment to mitigate attack path and control gap risks, andconvert technical exposure into a solution to buy time to remediate riskEstablish andmaintain interim controls that reduce exploitability and limit business impactwhile infrastructure and application teams correct underlying weaknesses; Define expiration dates, monitoring requirements, escalation paths, andevidence needed to confirm that temporary controls remain effectiveOversee theintegration of GCP and Workbench security tooling integration, automations, andprocesses while keeping current with the latest cybersecurity practices andtechnologiesDevelop operating plans and governance models thatsupport multi-cloud and federated remediation; Define accountability, decisionrights, compensating-control requirements, risk-acceptance criteria, escalationthresholds, and executive metrics that hold distributed teams accountable forsustained exposure reductionAct with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment" We need to split by semicolons into items. Also note some missing spaces due to OCR: "anenterprise", "technologylifecycle", etc. We should preserve as is but maybe add spaces? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. We should not correct OCR errors? It's ambiguous. Probably we should keep the text exactly as given, but we could add spaces for readability? That would be inventing. Better to keep as is, but the missing spaces may affect readability but it's still the same info. We'll keep the exact strings. Thus each item: - Build and lead anenterprise cybersecurity countermeasures program across the full technologylifecycle - Define the strategy, scope, priorities, funding needs, governance,and measures required to prevent, detect, contain, and reduce exploitableweaknesses across applications, cloud services, infrastructure, endpoints, anddata environments - Operationalize acountermeasures and multi-cloud security program through repeatable processes,integrated workflows, clear ownership, service-level objectives, risk-basedprioritization, exception management, validation standards, and executivereporting - Maintain reliable coverage, data quality, access governance,lifecycle management, and control-effectiveness monitoring - Direct preventive countermeasures throughoutdevelopment and deployment to mitigate attack path and control gap risks, andconvert technical exposure into a solution to buy time to remediate risk - Establish andmaintain interim controls that reduce exploitability and limit business impactwhile infrastructure and application teams correct underlying weaknesses - Define expiration dates, monitoring requirements, escalation paths, andevidence needed to confirm that temporary controls remain effective - Oversee theintegration of GCP and Workbench security tooling integration, automations, andprocesses while keeping current with the latest cybersecurity practices andtechnologies - Develop operating plans and governance models thatsupport multi-cloud and federated remediation - Define accountability, decisionrights, compensating-control requirements, risk-acceptance criteria, escalationthresholds, and executive metrics that hold distributed teams accountable forsustained exposure reduction - Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment Check if any missing due to line breaks. The original had some line breaks but we treat as semicolons. Now Qualifications block: "Minimum eight years of recent experience in security architecture, preferably with a specialization in Google Cloud Platform (GCP) security (data loss prevention and SecOps) and the Wiz product suite (Code, Cloud, Defend,Exposure Management), and security tooling integration; deep technicalexpertise across multiple technical domains, including security incidentresponseBachelor's degree from an accredited college or university is preferred; Minimum of a high school diploma or GED is required; certifications in certified information systems security professional (CISSP) and google professional cloud security engineer are preferredExperience leading and managing information technology (IT) security resources and/or projects with demonstrated ability to define, document, and peer review technical security standards; experience with security related regulatory requirements, such as National Institute of Standards and Technology (NIST), ISO 27001, and Health Insurance Portability and Accountability Act (HIPAA) plans, project estimations and budgetingCapability to influence without authority in a matrixed environment and develop resource plans, project plans, project estimations and budgeting Ability to foster the development of high-performance teams and interface with all levels of the organization; ability to participate in development of resource plans and structures and influence organizational prioritiesExcellent verbal/written communication, collaboration, analytical and presentation skills to lead an environment driven by customer service and teamwork; must be able to set goals and participate in strategic initiatives for a teamApplicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)" We need to split by semicolons. Let's parse: 1. Minimum eight years of recent experience in security architecture, preferably with a specialization in Google Cloud Platform (GCP) security (data loss prevention and SecOps) and the Wiz product suite (Code, Cloud, Defend,Exposure Management), and security tooling integration 2. deep technicalexpertise across multiple technical domains, including security incidentresponse 3. Bachelor's degree from an accredited college or university is preferred 4. Minimum of a high school diploma or GED is required 5. certifications in certified information systems security professional (CISSP) and google professional cloud security engineer are preferred 6. Experience leading and managing information technology (IT) security resources and/or projects with demonstrated ability to define, document, and peer review technical security standards 7. experience with security related regulatory requirements, such as National Institute of Standards and Technology