Information Security Specialist (Security Posture Insights, Reporting and Remediation)

The Information Security Specialist Security Posture Insights Reporting and Remediation is responsible for turning infrastructure configuration and cyber technology compliance data into trusted insights decision-ready reporting and measurable remediation outcomes. The role identifies material control gaps assesses trends and root causes prioritizes issues based on risk and business impact and works with accountable technology owners to drive remediation within established timelines. As a key business and product partner for the ServiceNow Configuration Compliance Management module the specialist defines reporting and workflow requirements uses the platform to manage findings through closure and develops dashboards metrics and executive insights that improve accountability and risk decisions. The role also advances AI-enabled security insights and risk management by improving data quality automating analysis and reporting and enabling responsible use of predictive signals and remediation recommendations. The role reports to the Senior Manager Security Compliance and Operations Management and works across infrastructure security governance security engineering technology operations ServiceNow delivery asset management risk and audit teams.

Role and Responsibilities

• Analyze infrastructure configuration asset security tool and control data to identify material compliance gaps recurring trends emerging risks and systemic root causes across server workstation network database middleware cloud and container environments.

• Produce accurate timely and decision-ready operational and executive reporting on security posture including compliance performance control coverage configuration drift issue aging remediation progress threshold breaches exceptions and residual risk.

• Develop and maintain dashboards scorecards KRIs KPIs and management insights that clearly communicate what is non-compliant why it matters who is accountable the required action and when remediation is due.

• Use ServiceNow Configuration Compliance Management as the system of record for findings ownership remediation tasks service-level commitments exceptions evidence validation escalation and closure.

• Define and prioritize ServiceNow Configuration Compliance requirements for data ingestion findings normalization assignment logic remediation workflows notifications escalations dashboards metrics and executive reporting.

• Develop actionable insights from ServiceNow Configuration Compliance CMDB Splunk and security assessment tools by correlating compliance gaps with asset criticality exposure business context control criticality and remediation history.

• Establish risk-based prioritization and reporting models that direct remediation capacity to the gaps with the greatest potential business and security impact.

• Work directly with accountable technology and remediation owners to establish corrective action plans clarify deliverables and due dates resolve blockers monitor progress validate remediation evidence and confirm sustainable closure.

• Lead governance routines for outstanding gaps including remediation reviews aging analysis challenge of recovery plans dependency management and escalation of overdue or material issues to accountable leaders and risk partners.

• Identify systemic or recurring gaps and recommend broader corrective actions including process improvements engineering fixes configuration baselines automation ownership changes and preventative controls.

• Validate reporting completeness and accuracy by reconciling authoritative asset inventories source-tool results ServiceNow records and remediation evidence; investigate data quality or control coverage gaps that could affect management decisions.

• Partner with ServiceNow platform data and engineering teams to improve Configuration Compliance integrations analytics workflow performance and reporting usability.

• Drive the roadmap toward AI-enabled security insights and risk management including anomaly detection trend forecasting root-cause analysis predictive risk indicators automated executive summaries and risk-based remediation recommendations.

• Define data quality validation explainability human oversight access and governance requirements so AI-assisted insights and recommendations are trusted traceable and appropriate for risk decisions.

• Develop automation requirements that reduce manual analysis improve reporting timeliness accelerate issue assignment and escalation and increase remediation velocity.

• Maintain clear data definitions reporting standards control mappings remediation procedures RACIs evidence requirements and decision records that support consistent operations and an auditable trail.

• Provide concise traceable evidence and reporting for senior management second-line risk audit and regulatory requests clearly distinguishing current posture open gaps remediation commitments and residual risk.

• Maintain a prioritized backlog and roadmap for insight generation reporting modernization ServiceNow Configuration Compliance improvements remediation enablement and AI-assisted analytics.

Qualifications

• University or post-graduate degree in Information Technology Computer Science Computer Engineering Cybersecurity Data Analytics or a related discipline is an asset.

• Seven or more years of experience in cybersecurity technology compliance security posture management infrastructure security risk reporting remediation management or security operations.

• Demonstrated ability to transform complex security and technology data into actionable insights concise executive reporting and clearly prioritized remediation actions.

• Advanced analytical skills including data correlation trend and aging analysis root-cause identification risk prioritization data reconciliation and interpretation of KRIs KPIs and control effectiveness measures.

• Hands-on experience developing dashboards scorecards and operational or executive reports that communicate material gaps ownership due dates progress dependencies and residual risk.

• Experience driving remediation with technology owners including corrective action planning milestone tracking blocker resolution evidence validation challenge escalation and closure.

• Experience with ServiceNow Security Operations capabilities; experience using or defining requirements for the ServiceNow Configuration Compliance Management module CMDB findings workflows remediation tasks dashboards and integrations is strongly preferred.

• Experience using security assessment and posture data from tools such as Qualys CrowdStrike Wiz Azure Policy TenableAppOmni Splunk or comparable platforms.

• Strong understanding of configuration compliance control completeness and correctness asset inventory configuration drift exception management service-level commitments and risk-based remediation.

• Ability to assess reporting accuracy and data quality across multiple sources and explain the limitations assumptions and risks that could affect management decisions.

• Working knowledge of AI and machine-learning use cases for security analytics including anomaly detection summarization recommendations and predictive risk signals with an understanding of explainability validation governance and human oversight.

• Ability to communicate complex technical and risk information in concise business language for technology owners senior leaders risk partners auditors and regulators.

• Experience coordinating cross-functional delivery across security governance security engineering technology operations asset management data platform teams and first- and second-line risk functions.

• Strong organizational prioritization and influencing skills with the ability to establish accountability manage competing remediation priorities and deliver outcomes with limited supervision.

• Experience working within Agile delivery frameworks and using tools such as Jira is an asset.

Certifications:

• Completion of at least three of the following: GIAC (GCIA GPEN GWAPT GCIH GSEC andetc) CCNP CCNACISSPCCSP CISM CISA