Information Security Assurance Analyst I

We need to output HTML fragment with headings

for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title. Must not include Job ID etc. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove links like https... and LinkedIn link. Also remove "Applicant must be authorized to work in the U.S...." maybe that's a requirement? It's about work authorization; could be considered a requirement. But it's a legal statement; might be considered boilerplate? The instruction says remove EEO/equal-opportunity/scam-warning boilerplate. Work authorization is not EEO but could be considered a requirement. However it's a legal requirement; maybe keep as part of Requirements? The instruction: "Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate". Work authorization is legal but not EEO. Might be okay to keep as a requirement. But we need to see if there is any specific content for Benefits, Pay, Schedule. The posting includes a link to benefits page but no explicit benefits listed. So we should not create Benefits section unless posting actually states them. It only says "https://jobs.globalpayments.com/en/why-global-payments/benefits/" but no details. So we should not include Benefits. Pay and Schedule not mentioned. So we omit those sections. We need sections: About the role (maybe from introductory paragraph?), Responsibilities (What You’ll Own), Requirements (What You’ll Bring), Qualifications (maybe overlapping with Requirements? The posting has "What You’ll Bring" includes education, experience, certifications, etc. Could treat as Requirements. Qualifications maybe similar; but we should not create thin sections. We could combine into one Requirements section that includes education, experience, certifications, etc. Or we could have Requirements and Qualifications separate if there is distinct content. The posting includes "What You’ll Bring" which lists education, experience, certifications, etc. That's basically qualifications. There's also a separate "Skills / Knowledge" section later. So we can have: - About the role: introductory paragraph(s) before "What You’ll Own". That includes: "Ready to take your career global? Make your mark at one of the biggest names in payments. We are seeking a candidate who can provides technical guidance on information security policies, procedures, technologies, and compliance-related activities through execution of First Line Assurance assessments. Works with stakeholders across Information Security and Technology organizations to validate security control implementation and effectiveness, identify vulnerabilities and control gaps, support remediation activities, and contribute to certification, continuous monitoring, and automation programs. Automation emphasis: This First Line Assurance role supports an automation-first model for control audits, evidence collection, reporting, certification, and continuous monitoring. Experience with Power Automate, Power BI, dashboards, and workflow automation is highly desirable." We can put that as About the role. - Responsibilities: "What You’ll Own" bullet points (the long list). We need to convert to

• . Must preserve all substantive information, not invent or summarize away detail. We need to keep each sentence as a list item? The instruction: Use
  • for any list of duties/requirements/benefits. So we can treat each sentence or clause as a list item. We should not lose detail. We'll split by sentences. - Requirements: maybe combine education/experience/certifications from "What You’ll Bring". Could be a list. - Skills: from "Skills / Knowledge" section. We should not include duplicated lines. Ensure we don't include filler like "Not an exhaustive list; other duties as assigned." That's substantive? It's a note; we could include as a list item maybe. It's not filler; it's a statement. We'll keep. We must not include the LinkedIn link, the benefits URL, the work authorization statement? Might be considered a requirement; but it's a legal statement. I'd keep it as a requirement item: "Applicant must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; We will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)." That's quite long but it's a requirement. We'll include. Now produce HTML. Structure:

    About the role

    ... (the intro paragraph(s) combined into one or multiple paragraphs). We'll keep as

    with the text. Then

    Responsibilities

    • ... each duty.
    Then

    Requirements

    • ... each requirement (education, experience, certifications, work authorization, etc.)
    Then

    Skills

    • ... each skill/knowledge item.
    We must not add extra sections like Benefits, Pay, Schedule. Check for duplication: The "What You’ll Own" includes many sentences; we need to ensure we capture all. Let's extract the "What You’ll Own" paragraph: "Collaborates with Information Security, Technology, Risk, Audit, and business stakeholders to support First Line Assurance objectives. Aligns assessment activities with business priorities and communicates findings in a clear, actionable manner. Performs targeted control assessments, operational assurance reviews, post-deployment security validations, and certification activities. Evaluates security control implementation and effectiveness, identifies control weaknesses and compliance gaps, assists with remediation tracking, and provides detailed findings and recommendations to stakeholders. Supports the automation of control audits, evidence collection, control testing, reporting, remediation tracking, certification, and continuous monitoring. Contributes to workflows, dashboards, data collection, and repeatable assessment processes that reduce manual effort and increase assurance coverage. Uses automation and reporting tools to streamline evidence collection, control validation, assessment execution, remediation tracking, and recurring assurance activities. Experience with Power Automate, Power BI, or similar workflow and reporting technologies is desirable. Supports continuous monitoring, assurance, and validation activities by reviewing technical, administrative, and operational security controls. Analyzes assessment results, assists in development of automation opportunities, tracks remediation efforts, and contributes to recurring certification and reporting activities. Reviews business requests, assurance findings, and control exceptions to determine level of risk and appropriate remediation path. Informs management of security policy variances and control gaps. Not an exhaustive list; other duties as assigned." We need to keep each as list item. Now "What You’ll Bring": "Bachelor's and/or Master’s Degree in Computer Science, Information Security, or related information technology field, and/or a combination of equivalent and relevant work experience. Minimum 7+ years relevant experience in information security, security assurance, audit, risk, compliance, security architecture, security engineering, or related technology functions. Knowledge of industry standard security and compliance programs and frameworks including PCI, FFIEC, FISMA, SOX, GLBA, HIPAA, ISO-87001, NIST 800-53, NST CSF, NIST RMF, and/or related security control frameworks. Ability to work with stakeholders at multiple levels to identify risk, collect and evaluate evidence, document findings, and communicate practical remediation options. Required Certification(s) / Licensing - Professional certifications such as CRISC, CGRC, CISM, CISSP, CISA, CySA+, or equivalent experience are preferred. It’s a bonus if you have Strong familiarity with on-prem, cloud, and hybrid environments, across connected and disconnected environments, in a complex and diverse Fortune 500. Familiarity with multiple cloud hosting environments is preferred, or at least strong familiarity in one of the three main cloud provider environments such as GCP, AWS, or Azure. Experience performing information security assessments, security control assessments, technical control testing, control design testing, control effectiveness testing, KPI/KRI testing & validation, operational assurance reviews, or post-deployment validation activities. Experience designing, implementing, or supporting automated security control validation processes, tooling, and infrastructure, to include strategic and continuous monitoring, audit resiliency, and/or evidence collection processes is highly desirable. Experience with Microsoft Power Apps Platform, including Power Automate and Power BI, or other metric and reporting data structures is desirable. Experience developing dashboards, metrics, assessment reports, or recurring assurance reporting from multiple data sources. Familiarity with workflow automation platforms such as ServiceNow and assessment or evidence tracking platforms such as Optro (fka AuditBoard), Archer, or similar audit / GRC tools. Knowledge of continuous monitoring, control validation, compliance automation, evidence collection, and remediation tracking concepts. Strong analytical, communication, and stakeholder management skills, with the ability to translate technical evidence into business-focused recommendations." Also the work authorization statement after that: "Applicant must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; We will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)." We'll include that as a requirement item. Now "Skills / Knowledge": "Having broad yet in-depth expertise and unique knowledge, uses skills to set and ensure success of company objectives and principles and to achieve goals in creative and effective ways within environments and situations that are complex and difficult. Having ownership of a function, major account, or matrix management responsibilities, uses knowledge to ensure success, strengthen relationships, expand the business through key initiatives, and lead matrix teams on complex projects. Job Complexity - Works on issues that impact security assurance, technology risk management, control effectiveness, automation, reporting, and future concepts, products, or technologies. Creates formal networks with key decision makers and serves as a trusted partner to Information Security, Technology, Risk, Audit, and business stakeholders. Supervision - Exercises wide latitude in determining objectives and approaches to critical assignments." We'll treat each sentence as list item. Now the "About The Team" and later paragraphs are likely boilerplate about culture; we should remove as per instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The "About The Team" is not exactly boilerplate but could be considered fluff; but it's substantive? It's about team culture. The instruction says "Prefer a few substantive sections over many thin ones." Could we include a section like "About the Team"? Not in the allowed headings list; only those headings are allowed. So we must not create a section for About the Team. So we omit that content. Also the "What makes a Globalpayer?" etc. Also boilerplate; omit. Now produce HTML. We need to ensure we don't include any markdown fences. Just raw HTML. Let's craft. First, About the role paragraph: combine the intro sentences into one

    . Might be long but okay. Intro text: "Ready to take your career global? Make your mark at one of the biggest names in payments. We are seeking a candidate who can provides technical guidance on information security policies, procedures, technologies, and compliance-related activities through execution of First Line Assurance assessments. Works with stakeholders across Information Security and Technology organizations to validate security control implementation and effectiveness, identify vulnerabilities and control gaps, support remediation activities, and contribute to certification, continuous monitoring, and automation programs. Automation emphasis: This First Line Assurance role supports an automation-first model for control audits, evidence collection, reporting, certification, and continuous monitoring. Experience with Power Automate, Power BI, dashboards, and workflow automation is highly desirable." Note: there is a grammatical error "can provides". We keep as is. Now Responsibilities list. We'll produce

    • for each sentence. Make sure to preserve punctuation. Now Requirements