Job description:

This position project manages the Trust Services Privacy department initiatives that are internally reviewed to ensure compliance with enforced policies to comply with all Data Privacy Management and compliance obligations. Existing privacy compliance obligations include GDPR, ISO 27K privacy related standards, Data Privacy and related security and privacy policies and processes. 

 

The Privacy Pro should be familiar with

• Privacy as Trust as a central theme of organizational culture, how it acts as a market differentiator, and relates to consumer confidence.
• Privacy by Design and Default principles, privacy enhancing techniques that include methods of de-identifying techniques, user access models, among other strategies that protect data throughout the data lifecycle.

 

Privacy Pro will

• be responsible for leading privacy-enhancing initiatives for Cloud applications and services including artificial intelligence and machine learning (AI/ML) programs, strategic privacy advisory services, infrastructure reviews, software architecture designs, and business process reviews for alignment to privacy regulations.
• will work closely with product development, application security, and security operations  to ensure the effectiveness of current privacy and security controls of cloud hosting infrastructure services. 

 

 

S/He acts as single point of contact with the process owners to identify areas of concern, develop the relevant solutions, provide management response, track progress and drive actions to completion. S/he performs ongoing periodic walkthrough and controls testing for compliance projects, including audits for IT projects, applications, operations and environments for adherence to corporate security and privacy policies and guidelines and monitors compliance and completion of any remediation or process improvements agreed with management. This position requires coordinating, communicating, and working effectively with prospects, customers, internal process owners, internal and external auditors, and all levels of management.

 

DUTIES:

 

Perform gap and readiness assessments for Privacy by Design and Default principles, privacy enhancing techniques that include methods of de-identifying techniques, user access models, among other strategies that protect data throughout the data lifecycle. focused on privacy guidelines in (i.e. GDPR, CCPA,  ISO 27018, ISO 27701, etc): Agree objective, goals, and scope of the project with senior management. Obtain management support and commitment of resources for the assessment Assess adequacy of existing systems, products and processes, and controls against the requirements of the compliance obligation Work with management to draft and implement remediation plans to mitigate identified issues and risks, and improve processes and controls If working with staff, review staff output, provide guidance on project next steps, and supervise and guide staff in working with internal customers Perform periodic audits of IT projects, applications, operations and environments for adherence to corporate privacy and security policies and guidelines.  Enforce compliance with policies and standards in conjunction with internal audit, developing, managing and monitoring security over business processes.  Provide guidance and advice to the organization with current information on related regulatory issues and compliance technologies.

Build privacy engineering programs, including plan, process, scope, procedures, questionnaires and schedules

Help develop new practices, products, procedures for products lines or GBU sub-functions.

Develops and executes programs and processes to reduce information security risk and strengthen Oracle’s security posture.

Supports the strengthening of Oracle’s security posture, focusing on one or more of the following: risk management; regulatory compliance; threat and vulnerability management; incident management and response; security policy development and enforcement; privacy; information security education, training and awareness (ISETA); digital forensics and similar focus areas. Risk Management: Assesses the information security risk associated with existing and proposed business operational programs, systems, applications, practices and procedures in complex, business-critical environments. May conduct and document complex information security risk assessments. May assist in the creation and implementation of security solutions and programs. Regulatory Compliance: assists in programs to establish, document and track compliance to industry and government standards and regulations, e.g. ISO-27001, PCI-DSS, HIPAA, FedRAMP, GDPR, etc. Researches and interprets current and pending governmental laws and regulations, industry standards and customer and vendor contracts to communicate compliance requirements to the business. Threat and Vulnerability Management: May research, evaluate, track, and manage information security threats and vulnerabilities in situations where analysis of well-understood information is required. Incident Management and response: Responds to security events, identifying possible intrusions and responding in line with Oracle incident response playbooks. Digital Forensics: May conduct data collection, preservation and forensic analysis of digital media independently, where a basic understanding of forensic techniques is required. Other areas of focus may include duties managing Information Security Education, Training and Awareness programs. In a Corporate Security role, may manage the creation, review and approval of corporate information security policies. Compiles information and reports for management.

Minimum of 5 years experience in information systems, business operations, or related fields, at least 2 years of which must be from at least one of the following: Information security risk management; information security program management; Industry/Government security compliance program management (ISO-27001, GDPR, HIPAA, FedRamp, etc.); threat and vulnerability management; incident management and response; security policy development and enforcement; privacy, information security education, training and awareness (ISETA), information security solutions development, etc. required. Preferred but not required qualifications include: Bachelor-level university degree in a relevant field from an accredited university, or equivalent. CISSP, CISM, CISA , CIPP or other equivalent certification. Experience managing security incidents and vulnerabilities through their life cycle. Experience designing and developing automated process for responding to possible network intrusions. Knowledge of secure software design principles and the software development life cycle. Experience with at least 1 automation language or framework (Python, Ruby, SALT, Terraform, etc.) or vulnerability scanning tool (Qualys, Burp Suite, etc.).

As part of Oracle's employment process candidates will be required to successfully complete a pre-employment screening process. This will involve identity and employment verification, professional references, education verification and professional qualifications and memberships (if applicable).