Policy, Risk and Control (PRC) Methodology Specialist

About the role

EY Information Security's Technology Assurance, Risk and Policy (TARP) function runs a global Governance, Risk and Compliance (GRC) program. The Policy, Risk and Controls (PRC) Enablement & Awareness team sets policies and procedures for safeguarding the digital environment, and the PRC Methodology Program integrates the IT PRC Framework with the core GRC platform. The PRC Methodology Specialist administers and enhances this framework and works with the Global Methodology Program Lead.

Key responsibilities

• Serve as subject matter expert in IT risk management, governance, compliance and control frameworks, promoting consistent interpretation and adoption of the IT PRC Framework.
• Lead continuous improvement of the IT PRC Framework operating model through research into industry trends, emerging risks and regulatory changes.
• Identify and recommend process improvements and operational efficiencies, and maintain documentation, processes and procedures.
• Develop cross-mappings of PRC common controls against information security policies, standards and regulatory requirements.
• Partner with Risk, Control, Compliance and Assessment teams on control gap assessments and alignment of risks, controls and regulations.
• Support the use of GRC tools such as the Unified Compliance tool.
• Facilitate stakeholder engagement and help promote a culture of risk awareness.

Required profile

• 3-5 years of progressive experience in IT, information security, security compliance, IT audit, IT risk management or related fields.
• Advanced degree in Computer Science, Information Security, Risk Management or a related field, or equivalent experience.
• Experience in global, cross-functional and virtual teams; strong English skills.
• Ideally: experience with methodology, governance, policy or control frameworks, highly regulated environments, executive presentations, and policy lifecycle management.

Required skills

• GRC principles and familiarity with Archer or comparable GRC platforms.
• Standards and frameworks such as ISO, NIST, COBIT, PCI DSS, the Unified Compliance Framework, and regulations such as GDPR, DORA, CRA and SOX.
• Ability to evaluate control effectiveness and recommend control improvements.
• Microsoft Office and M365 (Word, Excel, PowerPoint, SharePoint, PowerApps, Power BI); generative AI is mentioned as useful.