Public Company Accounting Oversight Board (PCAOB)

Security Engineer

• Responsible for the strategic leadership, implementation, monitoring, reporting, and continuous improvement of the PCAOB's information security program.
• Work with PCAOB leadership, divisions, and offices to oversee and mature the operations of a PCAOB-wide information security organization with a common goal in information security and cybersecurity risk.
• Provide leadership and foster collaboration with risk, compliance, and legal teams and business stakeholders to ensure a secure approach to innovation and the application of artificial intelligence (A.I.).
• Provide leadership and promote automation for configuration and deployment in support of Security Operations (SecOps); manage institution-wide information security processes by leading OT information security staff to maintain an effective information security program and implement associated priorities.
• Lead efforts to continually assess, evaluate, and make recommendations to management regarding the adequacy of the IT general and security controls for the PCAOB and technology systems which requires a proactive, hands-on approach.
• Develop, implement, and administer technical cybersecurity standards, as well as the suite of security services and tools, and align to existing PCAOB policies, frameworks, and procedures.
• Design and implement a tactical structure to address Security Operations Center (SOC) structures to better enable outage notifications, security risks/threats, or elevation of incidents that occur within the PCAOB environment.
• Establish annual and long-range cybersecurity and compliance goals, align with data and technology strategies, create and monitor Key Performance Indicators (KPI), and forge a multi-year information security roadmap.
• Proactively identify, assess, and prioritize IT risks to data and systems in coordination with OT portfolio management and OERM including internal/external threats, cyber-crimes, and vendor/third-party risks; partner with OERM or relevant stakeholders on the appropriate courses of action to mitigate or eliminate risk.
• Lead a technical team to proactively work with business units across the PCAOB to implement practices and ensure implementation of technological controls that meet agreed-on policies and standards for information security.
• Lead the development and implementation of effective frameworks, relevant policies, processes, and practices to secure protected and sensitive data in accordance with the PCAOB’s Information Sensitivity Classification ensuring compliance with relevant legislation and legal interpretation.
• Collaborate and coordinate with the CRO to identify, evaluate, and report on OERM organizational-level risk reports to the Board in areas such as legal and regulatory, IT, and cybersecurity risk, while supporting and advancing business objectives.
• Provide leadership supporting a team to streamline and maintain a modern compliance model for cybersecurity safeguards, including access controls, MFA, encryption, asset classification, change management, patch management, network segmentation, firewalls, detection technologies including network and endpoint security, insider threat protection, logging and network monitoring, and vulnerability management.
• Conduct and support regular internal and external security assessments, tabletop exercises, penetration tests, playbook development, and red/purple team exercises to proactively test the effectiveness of security controls including OT Security Program Assessments and corrective action plans.
• Keep abreast of security incidents and act as primary control point during significant information security incidents; convene a Security Incident Response Team (SIRT) as needed, or requested, in addressing and investigating security incidences that arise. This may require availability off hours, as applicable.
• Mature education and awareness programs and advise PCAOB leadership at all levels on security issues, best practices, and vulnerabilities.
• Examine impacts of new technologies on the PCAOB's overall information security; establish processes to review implementation of new technologies to ensure security compliance.
• Perform the full range of supervisory duties, including resource allocation plans, evaluating employee performance; making recommendations for appointment and promotion; hearing and resolving complaints; identifying development and training needs of employees; other related supervisory tasks.

Chief Information Security Officer