GRC Information Security Risk Manager (Finance)

Description

About Alvarez & Marsal

Alvarez & Marsal (A&M) is a global consulting firm with over 10,000 entrepreneurial, action and results-oriented professionals in over 40 countries. We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential. Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry. The collaborative environment and engaging work-guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity-are why our people love working at A&M.

Global Security Office - Governance, Risk and Compliance (GRC):
Alvarez and Marsal Global Security Office is committed to delivering the highest standards of security and compliance. We are seeking a highly skilled and motivated Information Security Risk Manager to lead on A&M wide information security risk management program and join our dynamic and growing team based in either our London or Tampa office.

Position Summary:
The Information Security Risk Manager will play a critical role in, and will be responsible for, driving risk strategy, overseeing risk governance, managing senior-level reporting, and leading key information security risk initiatives across the Alvarez and Marsal

This role will be focused on the managing and maintaining the Global Security Office Information Security Risk Register, its supporting processes, governance and reporting requirements. The successful candidate requires a strong understanding of ISO 27001 security controls, exposure to the OnSpring GRC Tool and can effectively assess and communicate technical security requirements to teams across the firm.

Key Responsibilities:

Risk Management Leadership and Oversight:

• Working to A&M Policy and industry standards and lead the end-to-end information security risk management process, to ensuring risks are proactively identified, assessed, recorded, and mitigated.
• Assess and prioritize security risks based on enterprise-wide impact, likelihood, and mitigation strategies.
• Act as a trusted security advisor, working cross-functionally with IT, legal, compliance, Internal Audit, AI Centre of Excellence and other business leadership teams to drive a culture of risk awareness.
• Ensure that all security risks align with regulatory requirements such as ISO 27001, NIST, GDPR, and other international security frameworks.
• Provide oversight and work closely with risk owners manage the development, implement treatment plans to address identified risks, ensuring alignment with senior leadership expectations and business objectives.

GRC Tool (OnSpring) Management:

• Own, manage and continuously develop A&M GRC platform (OnSpring) to provide a structured, scalable risk register and reporting capabilities to support A&M wide requirements, and support ISO 27001:2022 certification requirements.

Risk Audit Requirements:

• Complete annual formal risk assessment including control maturity assessment and asset register revision.
• Work closely with Internal Audit to ensure audit compliance and delivery for ISO 27001
• Support ownership of minor non-conformities log of internal and external audit finding through to reporting, remediation and closure.
• Attend ISO 27001 external audits for InfoSec Risk Management related compliance requirements.

Risk Governance:

• Organize and facilitate bi-weekly Global Security Office Risk Management meetings, providing comprehensive tracking and updates on risk triage activities, critical risk register change and general risk reporting mitigation strategies.
• Prepare and deliver quarterly risk updates to the Information Security Steering Committee and executive leadership, providing strategic insights in information security against A&M Security Objectives.
• Support risk input to bi-annual Executive Security Management Reviews

Support Global Security Office SOC on Incident Response Leadership:

• Provide GRC oversight during security incidents, guiding the organization's response and ensuring effective risk mitigation and reporting.

Key Skills & Experience:

• Experience in Information security risk management, governance, and compliance.
• Proven leadership in enterprise risk management and security governance frameworks.
• Hands-on exposure to GRC tools (e.g., OnSpring, Archer, ServiceNow, or similar).
• Background knowledge of risk assessment methodologies and security frameworks such as ISO 27001, NIST, and CIS
• Experience managing and directing enterprise-wide Information Security risk triage, risk recording, treatment planning, and reporting.
• Ability to translate complex security risks into actionable business strategies for executive stakeholders.
• Strong analytical, strategic thinking, and decision-making skills.
• Excellent written and verbal communication skills, with demonstrated experience presenting risk insights to executive leadership and board members.
• Relevant senior security certifications (e.g., CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor) are highly desirable.

Your journey at A&M

We recognize that our people are the driving force behind our success, which is why we prioritize an employee experience that fosters each person's unique professional and personal development. Our robust performance development process promotes continuous learning, rewards your contributions, and fosters a culture of meritocracy. With top-notch training and on the-job learning opportunities, you can acquire new skills and advance your career. We prioritize your well-being, providing benefits and resources to support you on your personal journey. Our people consistently highlight the growth opportunities, our unique, entrepreneurial culture, and the fun we have together as their favorite aspects of working at A&M. The possibilities are endless for high-performing and passionate professionals.

The salary range is $110,000 - $130,000 annually, dependent on several variables including but not limited to education, experience, skills, and geography. In addition, A&M offers a discretionary bonus program which is based on a number of factors, including individual and firm performance. Please ask your recruiter for details.

Full-time Positions and Part-time Positions Over 30 hours

Regular employees working 30 or more hours per week are also entitled to participate in Alvarez & Marsal Holdings' fringe benefits consisting of healthcare plans, flexible spending and savings accounts, life, AD&D, and disability coverages at rates determined periodically as well as a 401(k) retirement savings plan. Provided the eligibility requirements are met, employees will also receive an annual discretionary contribution to their 401(k) retirement savings plan from Alvarez & Marsal. Additionally, employees are eligible for paid time off including vacation, personal days, seventy-two (72) hours of sick time (prorated for part time employees), ten federal holidays, one floating holiday, and parental leave. The amount of vacation and personal days available varies based on tenure and role type. Click here for more information regarding A&M's benefits programs