Senior Manager, Information Security (Security Risk Management), APEC

JOB SUMMARY The candidate will be responsible for governing vendor security risk management and cyber risk management for Asia Pacific excluding China, including conducting risk assessments and periodic re-assessments, reviewing security assessments and vulnerability reports, recommending remediation measures, and evaluating cybersecurity risks. He/She will also assist in engaging with vendors, service providers, and internal stakeholders to facilitate risk assessment and remediation activities, manage outcomes and results, and collaborate with stakeholders across IT and business departments to develop strategies for protecting company information and assets. Shares responsibility for planning, directing, and coordinating compliance and security review activities pertaining to technology projects for a given business unit. and ensuring project objectives are aligned with business requirements and security expectations.

The candidate will also support cybersecurity due diligence activities for mergers, acquisitions, and other strategic business development initiatives across Asia Pacific, including assessing technology environments, identifying security risks, reviewing third-party dependencies, and coordinating remediation or integration requirements with relevant stakeholders.

The candidate will also work with other peers to coordinate, articulate, and track actions related to developing and driving the implementation of cybersecurity risk management plans for Asia Pacific, ensuring effective cybersecurity risk management practices, and engaging with business unit members on a wide range of cybersecurity and country-specific regulation matters related to cybersecurity to achieve overall business objectives. The candidate will also be responsible for supporting the overall Asia Pacific security program, including security policy, procedures, and standards, ensuring Marriott IT documentation complies with Marriott security policies and procedures, and reviewing documents for accuracy and completeness. Excellent communication skills are required to effectively communicate (verbally and in writing) with stakeholders at all levels of the organization.

CANDIDATE PROFILE

Education and Experience

Required:

• Bachelor’s degree in information systems or related field or equivalent experience/certification
• 8+ years of experience in information security governance, cyber risk management, compliance, IT audit, or security audit, including at least 3 years of direct experience in third-party security risk management.
• Experience leading security risk assessment programs, cybersecurity initiatives, or governance activities across multiple business units or regions
• Fluent in English
• One or more current information security certifications such as Certified in Risk and Information Systems Controls (CRISC), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)

Candidate Attributes:

• Possession of good communication skills (including soft skills, structured thinking, effective report writing and presentations, and stakeholder engagement)
• A team player, with positive attitude and enthusiasm in the performance of responsibilities
• Strong innovative thinking, able to continuously enrich and improve the security policy, procedure, and standards.

Preferred:

• Security certification such as GWAPT, GPEN, AWS Certified Solution Architect - Associate, AWS Certified Solution Architect - Professional, AWS Security Specialty, PCI-related experience.
• Technical knowledge in one or more of the following areas is required: application security, cloud security, operating system security (UNIX, Windows, Mainframe, etc.), and network security (routers, switches, firewalls)
• Technical leadership experience in an outsourced environment
• Excellent communication skills and problem-solving ability
• Experience conducting and maintaining vendor risk assessments
• Experience reviewing and assessing security controls of cloud service providers
• Proficient in assessing multi-tiered system architecture (Web Server, App Server & Database)
• Knowledge of OWASP Top 10 and SANS 25.
• Experience reviewing vulnerability assessment, penetration testing, application security testing reports, and PCI DSS assessment/compliance reports.
• Familiarity with ISO27001, NIST Cybersecurity Framework, SOC 2, and PCI DSS Standards

• Experience supporting cybersecurity due diligence, integration risk assessments, or technology reviews for mergers, acquisitions, divestitures, or similar strategic business initiatives.

CORE WORK ACTIVITIES

Vendor Risk Management & Cyber Risk Management

• Oversee, evaluate, and support the documentation and validation processes necessary to assure that associates, information technology systems, and business processes meet the organization’s information assurance, security, and privacy requirements. Ensures appropriate treatment of risk, compliance, and assurance of internal policies and external regulations.
• Develop strategy for the vendor information security risk compliance program
• Perform security controls assessments of third-party providers – assess security architecture, adherence to the requirements, conduct application scanning and results validation
• Document controls gap analysis and risk assessment of the third-party providers
• Review controls exception requests and make risk-based approval decision
• Lead, participate or perform various infrastructure compliance initiatives and projects
• Review and assess the results of vulnerability assessments, application security testing, penetration testing, and other security assessment activities performed using tools such as Nessus, IBM AppScan, HP WebInspect, Fortify on Demand, Qualys, Burp Suite, or Retina
• Review, validate, and track remediation of findings identified through vulnerability assessments, penetration tests, application security assessments, and PCI DSS compliance assessments.
• Monitor compliance to applicable security policies and standards and report related risk issues
• Manage and administer processes and tools that enable the organization to identify, document, and track third-party risks and compliance exceptions
• Conduct assessments of threats and vulnerabilities, determine deviations from acceptable configurations or enterprise or local policy, assess the level of risk, and develop and/or recommend and operationalize appropriate mitigation countermeasures.
• Provide sound advice and recommendations to leadership and staff on a variety of relevant topics within the pertinent subject domain. Advocate policy changes and make a case on behalf of the company via a wide range of written and oral work products.
• Support cybersecurity due diligence for mergers, acquisitions, divestitures, and other strategic business initiatives across Asia Pacific.
• Assess target or acquired technology environments, security control maturity, third-party dependencies, identified gaps, and remediation requirements to support informed business and integration decisions.

Managing Projects and Priorities

• Champions leaders’ vision for product and service delivery.
• Thinks creatively and practically to develop, execute, and implement new project plans.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.
• Plans, develops, implements, and evaluates the quality of operations.
• Supports regulator inspections, coordinates submission preparation, and tracks remediations.
• Supports cyber regulation awareness program catering to various roles in the entity.

Delivering on the Needs of Key Stakeholders

• Understands and meets the needs of key stakeholders.
• Communicates concepts in a clear and persuasive manner that is easy to understand.
• Demonstrates an understanding of business priorities.
• Supports achievement of performance goals, budget goals, team goals, etc.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.

Providing Technical Support and Consultation

• Provides recommendations to improve the effectiveness of processes and programs.
• Demonstrates advanced knowledge of job-relevant issues, products, systems, and processes.
• Demonstrates advanced knowledge of function-specific procedures.
• Applies knowledge/judgment to achieve business goals.
• Foresees, identifies, and resolves problems.
• Keeps up-to-date technically and applies new knowledge to the job.
• Performs other reasonable duties as required for this position.

At Marriott International, we are dedicated to being an equal opportunity employer, welcoming all and providing access to opportunity. We actively foster an environment where the unique backgrounds of our associates are valued and celebrated. Our greatest strength lies in the rich blend of culture, talent, and experiences of our associates. We are committed to non-discrimination on any protected basis, including disability, veteran status, or other basis protected by applicable law.