Product Manager 1 - PRC Methodology Specialist

About the role

EY Information Security is looking for a Product Manager 1 (PRC Methodology Specialist) in Buenos Aires. The Technology Assurance, Risk and Policy (TARP) function builds a holistic Governance, Risk and Compliance (GRC) program, and the Policy, Risk and Controls (PRC) Enablement & Awareness team sets policies and procedures that are communicated and enforced across the organisation. The PRC Methodology Program sits in the Global Information Security Policy & Methodology team and aligns the IT PRC Framework with the core GRC platform.

Key responsibilities

• Administer and enhance the IT PRC Framework, integrating IT risk domains, risk categories, processes, control objectives, common controls, IS documents and authoritative sources from industry standards, control frameworks and regulations.
• Partner with the Global Methodology Program Lead to advance the program's service offerings, strategy and goals, including IT Risk Management.
• Contribute to implementing, maintaining and evolving the PRC Framework operating model and support its adoption across projects and initiatives.
• Act as a subject matter expert in IT risk management, governance, compliance and control frameworks, promoting consistent interpretation and application of the framework.
• Research industry trends, emerging risks and regulatory changes to continuously improve the framework and integrate best practices.
• Recommend process improvements and maintain documentation, processes and procedures.
• Develop cross-mappings of PRC common controls against security policies, standards and regulatory requirements to strengthen traceability and control coverage.
• Support control gap assessments with Risk, Control, Compliance and Assessment teams.
• Support the use of GRC tools such as the Unified Compliance tool.
• Facilitate stakeholder engagement and promote a culture of risk awareness through awareness campaigns.

Required profile

• 3 to 5 years of progressive experience in IT, information security, security compliance, IT audit, IT risk management or related fields.
• Advanced degree in Computer Science, Information Security, Risk Management or a related field, or equivalent work experience.
• Demonstrated knowledge of GRC principles and familiarity with Archer or comparable GRC platforms.
• Experience applying risk and control concepts to evaluate control effectiveness and recommend improvements.

Required skills

• Working knowledge of ISO, NIST, COBIT, PCI DSS, the Unified Compliance Framework and regulations such as GDPR, DORA, CRA and SOX.
• Strong analytical judgment, communication and collaboration skills, and ability to manage multiple priorities.
• Aptitude for learning and applying new technologies and tools.