Risk Remediation Assessor

About the Role

Capital One has a team of Information Security specialists who not only focus on security but are relationship experts risk assessment champions and resolve complex information security issues related to Capital Ones third parties. The Cyber Third Party Risk Reduction (CTPRR) program defines the framework and conducts the assessments which enable the business to protect sensitive information physical assets and confirms the Third Parties ability to provide continual services.

This role will partner with a community of internal and external stakeholders to ensure third party engagements receive the necessary CTPRR due diligence; evaluate the effectiveness of the third partys security environment and deliver a quality assessment report. It also supports ongoing security by working with the third parties to remediate any identified issues enabling effective risk management in alignment with business tolerance and industry requirements.

Those that work for this team pragmatic and practical in your understanding of risk and security but are also willing to know when to pull in experts and escalate. They challenge and innovate within their team to drive process improvements to elevate program efficiency.

What youll do:

• Support kick-off planning and scoping activities for cyber-focused risk assessments working with cross functional resources to understand the operational and technical aspects of Third Party engagement model.

• Analyse Third Party control environment data against Capital One security expectations; interpreting information security requirements and reasonably apply them to specific situations.

• Review and support execution and delivery of reports including executive summaries and work papers detailing the assessment. work completed evidence reviewed and identified gaps.

• Maintain relationships with Third Party management and other Enterprise colleagues to manage expectations of assessments and remediation including timing and assessment deliverables.

• Ensure compliance to program process and procedures.

• Maintain a thorough understanding of the program controls intent and test procedures.

• Support third parties in appropriately managing and remediating risks identified through assessments..

• Travel 10-25% which may include off-site locations to perform multi day assessments.

• Identify and support initiatives to drive ongoing process improvements.

Other Responsibilities Include

• Performing cyber-focused assessments of Capital One third parties identifying risks and delivering high-quality reports.

• Providing consultative services related to third party security while applying risk based judgement to information security issues.

• Driving risk remediation through advice and challenge.

• Ensuring risk is appropriately managed and escalated.

• Assisting Third Parties Third Party Managers or Accountable Executives with understanding risks identified.

Would be great if you had some of these:

• Experience in Information Security

• Experience in Supply Chain Management

• Experience in a Risk Management role related to Information Security Business Continuity Management or Supply Chain Management

• Experience with risk assessments encompassing PCI DSS NIST Framework physical security controls or IT operations management

• Experience communicating and presenting to senior management

• CISSP CISA or CRISC certification

If you require a reasonable adjustment please contact All information will be kept confidential and will only be used for the purpose of applying a reasonable adjustment.