Global Information Security Policy Specialist

About the role

EY is looking for an Information Security Policy Specialist to help create, maintain and communicate global information security (IS) policies and standards that protect EY and its clients' information assets. The role sits in the Global Information Security Policy, Methodology & Awareness team within the Policy, Risk, and Controls Enablement & Awareness group, which works inside the Technology Assurance, Risk, and Policy (TARP) function. It joins a global Information Security team of more than 950 professionals.

Key responsibilities

• Maintain a structured global framework for managing IS policies and standards throughout their lifecycle.
• Develop, update and maintain IS policies and standards with cross-functional teams, using international standards, industry practice, regulatory requirements and business needs.
• Assess IS policy gaps and recommend new or revised requirements aligned with business needs and industry practice.
• Review IS policies regularly to check their relevance, accuracy and continued applicability.
• Translate input from subject matter experts, vendors and industry sources into clear, consistent policies for technical and non-technical audiences.
• Align IS documents with related EY policies and standards, and communicate requirements through written guidance, presentations and stakeholder discussions.
• Contribute to proposals and written materials, and track and report on IS policy program metrics.

Required profile

• Bachelor's degree, preferably in Information Security and Assurance, Cybersecurity, Communications or a related field, or equivalent work experience.
• Five or more years of progressive experience implementing or operating a company document management program and document governance, or a similar role.
• Five or more years in security compliance, IT risk management, IT audit or Information Security assurance.
• Practical experience drafting IS policies, standards, guidelines, processes or procedures.
• Demonstrated project management or change management experience.

Required skills

• Knowledge of one or more frameworks or regulations such as ISO/IEC 27000, NIST, PCI DSS, ITIL, COBIT, GDPR or SOX.
• Proficiency in Microsoft Word, Excel and PowerPoint.
• Ideal candidates: experience with a policy inventory in a document management or GRC platform (e.g. ConvergePoint), Microsoft 365 tools (SharePoint, Power Apps, Power BI), and certifications such as CISSP, CRISC, CISM, CISA, CIA, GIAC, CSAP or SSAP.

What we offer

• A globally diverse team with opportunities to grow and develop your career.
• Flexible working arrangements considered, with an EY benefits package covering physical, emotional, financial and social well-being.
• Continuous learning, coaching and leadership development.