Job Description. No of Direct Reports : 0. Titles of Direct Reports: Size of Department: 5. Budget Responsibility (direct) :

Transcription

1 Job Description Job Title : Department : Compliance Analyst Information Technology Reporting to (Job Title) : Director of Risk, Security & Compliance No of Direct Reports : 0 Titles of Direct Reports: N/A Size of Department: 5 Budget Responsibility (direct) : N/A Revenue Responsibility (direct) : N/A Date of issue: 23 rd October 2015 Issued by (name): Guy Barratt Overall Purpose of Role : The Compliance Analyst is responsible for ensuring the smooth running of IT general controls for the Carnival UK IT department Sarbanes Oxley audit requirements. They will collect and collate control evidence as part of a formally conducted and planned review of activities, processes or services. They will also examine records as part of specified testing strategies for evidence of compliance with additional CUK audit requirements covering credit card transactions or the processing of personal data The role will also support the Risk Manager and work with the appropriate business units in maintaining business continuity plans. They will work with the business to develop recovery strategies to Carnival UK can continue to operate effectively in the event of a crisis. Responsibilities Maintain the inventory of all regulatory, commercial and organisational technology compliance requirements.

2 Support the creation and modification and annual review of all technology compliance policies. Create an IT risk assessment process and periodically assess the compliance risks against the relevant standards Carnival UK are subject to Identify the associated IT compliance control gaps and oversee the documentation, implementation and testing of the entire IT compliance control portfolio. Develop and direct IT compliance control monitoring programs to ensure IT compliancerelated risks are managed to the appropriate level Implement and maintain an IT compliance issue management tracking and resolution process that will address known issues, according to severity and potential impact to Carnival UK. Report the levels of IT compliance risk and control effectiveness to key stakeholders Coordinate audit-related tasks such as ensuring the readiness of IT managers and their organisations for audit testing and facilitate the timely resolution of any audit findings. Identify any IT compliance-related budget/financial spend required to achieve the desired IT compliance risk appetite of Carnival UK. Support the Risk Manager in the creation of an IT compliance training and awareness program that periodically educates the requisite end-user community on the relevant IT compliance requirements, and certifies their adherence to the relevant IT compliance controls. Professional Responsibilities Manage the operation and check effectiveness of all the Carnival IT general controls on an ongoing basis Create and manage a register of all third parties who have access to Carnival IT infrastructure and/or Carnival data Carry out audits of third party suppliers and review their security controls are in compliance with Carnival requirements Develop a strong working relationship with the business to develop and implement controls and configurations aligned with security policies and legal, regulatory and audit requirements. Develop and maintain IT Business Continuity and Major Incident Recovery plan and ensure that requirements in IT systems and infrastructure are reflected in the plan. Carry out annual Business Impact Analysis (BIA) ensuring that all authorised Plan and conduct BCP testing, identifying any gaps and ensuring all authorised Audit IT Disaster recovery process onboard and ashore, ensuring all authorised

3 HESS Responsibilities Lead by example by taking care of the health and safety of yourself and others Report all accidents, near miss incidents and work related ill health conditions to your manager and to the Facilities department. Follow safety rules and procedures Use work equipment, personal protective equipment, substances, and safety devices correctly Take part in safety training & risk assessments and suggest ways of reducing risks. Act safely in accordance with our Elev8 safety behaviours General Responsibilities Adheres to Corporate Policies and Procedures, including Code of Conduct, Audit Procedures and any control related responsibility for financial data entered, stored, or reported via business systems within employees control (list not exhaustive). To undertake ad hoc duties as required. Special Requirements (Equipment Used, External Contacts etc): Other Features of Job (travel, hours of work, working conditions etc): Main place of work will be the Carnival UK Southampton Office Periodic travel away from the office, ship visits or other Carnival operating companies Out of hours work as required Location: Southampton Offices Person Specification Education, Qualifications and Training Degree in information systems, or equivalent Carnival work experience. Certifications from ISC2 or ISACA or the ability/desire to achieve Desirable: Experience in managing compliance in the maritime industry

4 Experience Minimum of 3 years of IT or network security or Carnival UK focused experience A strong understanding of the business impact of security tools, technologies and policies. Experience working with legal, audit and compliance staff. Experience developing and maintaining policies, procedures, standards and guidelines. Experience with common information security management frameworks, such as International Standards Organization (ISO) 2700x, the IT Infrastructure Library (ITIL) and Control Objectives for Information and Related Technology (COBIT) frameworks. Familiarity with applicable legal and regulatory requirements, including, but not limited to, the U.S. Sarbanes-Oxley Act, Data Protection Act and PCI-DSS Ability to translate understanding of the Carnival goals and objectives into compliance requirements. Work Based Competencies Excellent verbal, written and interpersonal communication skills, including the ability to communicate effectively with the IT organisation, project and architecture teams, management and business personnel; in-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls; an excellent understanding of information security concepts, protocols, industry best practices and strategies. Strong project management skills and experience in creating and managing project plans, including budgeting and resource allocation. Proficiency in performing risk, business impact, control and vulnerability assessments, and in defining treatment strategies. Strong analytical skills to analyse security requirements and relate them to appropriate security controls. Behavioural Competencies Strong attention to detail and the ability to process meticulously and through to completion all routine tasks Strong written and verbal communication skills.

5 Strong customer/client focus, with the ability to manage expectations appropriately. Tenacity and resilience to ensure compliance requirements are met in challenging circumstances Provide a superior customer/client experience and build long-term relationships. Results driven with a willingness to succeed Able to meet and manage challenging deadlines Excellent influencing skills Work calm and collectedly under pressure