Business Relationship Support Associate - GPL Dedicated CSO 3

About the role

Secure access to information assets is critical to achieve business objectives. The Chief Information Security Officer (CISO) is responsible for establishing and maintaining the information security program to protect information assets, technology, applications, systems, infrastructure, and processes across PRA Group’s cloud and digital ecosystem. The CISO identifies, evaluates, and reports on legal, regulatory, IT, and cybersecurity risks while supporting business objectives, and works proactively with business units and ecosystem partners to implement policies and standards. This role serves as the process owner for confidentiality, integrity, availability, safety, privacy, and recovery of information, and must coordinate diverse drivers and constraints while maintaining objectivity and a strong business‑focused security posture.

Responsibilities

• Facilitate an information security governance structure through the implementation of a best‑practice governance program.
• Provide regular reporting on the current status of the information security program to technology and senior business leaders and the board of directors as part of a strategic enterprise risk management program.
• Work with the vendor management office to ensure that information security requirements are included in contracts by liaising with vendor management and procurement organizations.
• Create and manage a targeted information security awareness training program for all employees, contractors, and approved system users, and establish metrics to measure its effectiveness.
• Provide clear risk‑mitigating directives for IT projects, including mandatory application of controls.
• Lead the information security function across PRA to ensure consistent, high‑quality information security management in support of business goals.
• Determine the information security approach and operating model in consultation with stakeholders and aligned with risk management and compliance monitoring of nondigital risk areas.
• Manage the budget for the information security function, monitoring and reporting discrepancies.
• Develop an information security vision and strategy aligned to organizational priorities (Connect 5) and secure senior stakeholder buy‑in.
• Develop, implement, and monitor a comprehensive information security program to ensure confidentiality, integrity, availability, safety, privacy, and recovery of information assets.
• Assist with identification of non‑IT‑managed services (“business side IT”) and apply standard controls and rigor to these services.
• Conduct annual system administrator training.
• Work with business units to facilitate information security risk assessments and empower them to own and accept appropriate risk levels.
• Develop and enhance an up‑to‑date information security management framework based on ISO 2700X, ITIL, COBIT/Risk IT, and NIST Cybersecurity Framework.
• Develop and maintain a continuously updated document framework of information security policies, standards, and guidelines.
• Oversee approval and publication of information security policies and practices.
• Partner with the Chief Data Officer to create a DMBOK‑based framework for information ownership, classification, accountability, and protection.
• Provide input for the IT section of the company’s code of conduct.
• Create internal networks among information security, line‑of‑business executives, compliance, audit, physical security, legal, and HR teams to ensure alignment.
• Build and nurture external networks with industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, incidents, and cybersecurity risks.
• Liaise with external agencies, such as law enforcement and advisory bodies, to maintain a strong security posture and stay abreast of relevant threats.
• Liaise with the enterprise architecture team to embed security requirements into enterprise and reference architectures.
• Work with compliance staff to ensure all information is processed and stored in accordance with applicable laws and global regulatory requirements, including data privacy.
• Collaborate with the data privacy officer to incorporate data‑privacy requirements where applicable.
• Ensure security is embedded in the project delivery process by providing appropriate policies, practices, and guidelines.
• Manage and contain information security incidents and events to protect corporate IT assets, intellectual property, regulated data, and the company’s reputation.
• Monitor the external threat environment for emerging threats and advise stakeholders on appropriate actions.

Requirements

• Minimum of 7–10 years of experience in risk management, information security, and IT/OT roles, with at least 5 years in a senior leadership position.
• Sound knowledge of cloud environments and ability to apply security controls across cloud platforms.
• Excellent written and verbal communication skills; ability to convey security and risk concepts to technical and non‑technical audiences, including board members.
• Strong business‑management knowledge and working knowledge of information security risk management and cybersecurity technologies.
• Up‑to‑date knowledge of methodologies and trends in both business and IT (cloud).
• Proven track record developing information security policies, procedures, and programs that achieve excellence in dynamic business environments.
• Critical‑thinking and strong problem‑solving abilities.
• Knowledge of relevant legal and regulatory requirements, such as GLBA, GDPR, California Consumer Protection Act, SOX, HIPAA, and PCI‑DSS.
• Project‑management skills, including financial/budget management, scheduling, and resource management.
• Ability to lead and motivate an information security team, even with “dotted‑line” reporting structures.
• Exceptional influencing skills to achieve outcomes without formal reporting authority.
• High personal integrity and ability to handle confidential matters with sound judgment.

Qualifications

• Degree in business administration, a technology‑related field, or equivalent work/education experience.
• Professional security management certification(s) desirable (e.g., CISSP, CISM