Job description:

This position project manages the Trust Services Privacy department initiatives that are internally reviewed to ensure compliance with enforced policies to comply with all Data Privacy Management and compliance obligations. Existing privacy compliance obligations include GDPR, ISO 27K privacy related standards, Data Privacy and related security and privacy policies and processes.

 

The Privacy Pro should be familiar with

• Privacy as Trust as a central theme of organizational culture, how it acts as a market differentiator, and relates to consumer confidence.
• Privacy by Design and Default principles, privacy enhancing techniques that include methods of de-identifying techniques, user access models, among other strategies that protect data throughout the data lifecycle.

 

Privacy Pro will

• be responsible for leading privacy-enhancing initiatives for Cloud applications and services including artificial intelligence and machine learning (AI/ML) programs, strategic privacy advisory services, infrastructure reviews, software architecture designs, and business process reviews for alignment to privacy regulations.
• will work closely with product development, application security, and security operations to ensure the effectiveness of current privacy and security controls of cloud hosting infrastructure services.

 

 

S/He acts as single point of contact with the process owners to identify areas of concern, develop the relevant solutions, provide management response, track progress and drive actions to completion. S/he performs ongoing periodic walkthrough and controls testing for compliance projects, including audits for IT projects, applications, operations and environments for adherence to corporate security and privacy policies and guidelines and monitors compliance and completion of any remediation or process improvements agreed with management. This position requires coordinating, communicating, and working effectively with prospects, customers, internal process owners, internal and external auditors, and all levels of management.

 

DUTIES:

 

Perform gap and readiness assessments for Privacy by Design and Default principles, privacy enhancing techniques that include methods of de-identifying techniques, user access models, among other strategies that protect data throughout the data lifecycle.

• focused on privacy guidelines in (i.e. GDPR, CCPA, ISO 27018, ISO 27701, etc):
• Agree objective, goals, and scope of the project with senior management. Obtain management support and commitment of resources for the assessment
• Assess adequacy of existing systems, products and processes, and controls against the requirements of the compliance obligation
• Work with management to draft and implement remediation plans to mitigate identified issues and risks, and improve processes and controls
• If working with staff, review staff output, provide guidance on project next steps, and supervise and guide staff in working with internal customers
• Perform periodic audits of IT projects, applications, operations and environments for adherence to corporate privacy and security policies and guidelines.
• Enforce compliance with policies and standards in conjunction with internal audit, developing, managing and monitoring security over business processes.
• Provide guidance and advice to the organization with current information on related regulatory issues and compliance technologies.
• Build privacy engineering programs, including plan, process, scope, procedures, questionnaires and schedules
• Help develop new practices, products, procedures for products lines or GBU sub-functions.

Develops and executes programs and processes to reduce information security risk and strengthen Oracle’s security posture.

Supports the strengthening of Oracle’s security posture, focusing on one or more of the following: risk management; regulatory compliance; threat and vulnerability management; incident management and response; security policy development and enforcement; privacy; information security education, training and awareness (ISETA); digital forensics and similar focus areas. Risk Management: Brings advanced level skills to assess the information security risk associated with existing and proposed business operational programs, systems, applications, practices and procedures in very complex, business-critical environments. May conduct and document very complex information security risk assessments. May assist in the creation and implementation of security solutions and programs. Regulatory Compliance: Brings advanced level skills to manage programs to establish, document and track compliance to industry and government standards and regulations, e.g. ISO-27001, PCI-DSS, HIPAA, FedRAMP, GDPR, etc. Researches and interprets current and pending governmental laws and regulations, industry standards and customer and vendor contracts to communicate compliance requirements to the business. Participates in industry forums monitoring developments in regulatory compliance. Threat and Vulnerability Management: Brings advanced level skills to research, evaluate, track, and manage information security threats and vulnerabilities in situations where in-depth analysis of ambiguous information is required. Incident Management and response: Brings advanced level skills to respond to security events, identifying possible intrusions and responding in line with Oracle incident response playbooks. May operate as Incident Commander on serious incidents. Digital Forensics: Brings advanced level skills to conduct data collection, preservation and forensic analysis of digital media independently, where an advanced understanding of forensic techniques is required. Other areas of focus may include duties providing advanced level skills and knowledge to manage Information Security Education, Training and Awareness programs. In a Corporate Security role, may manage the creation, review and approval of corporate information security policies. Mentors and trains other team members. Compiles information and reports for management.

Minimum of 8 years experience in information systems, business operations, or related fields, at least 5 years of which must be from at least one of the following: Information security risk management; information security program management; Industry/Government security compliance program management (ISO-27001, GDPR, HIPAA, FedRamp, etc.); threat and vulnerability management; incident management and response; security policy development and enforcement; privacy, information security education, training and awareness (ISETA), information security solutions development, etc. required. Strong knowledge of: Cloud architecture and security principles. Risk Management Frameworks. *nix and Windows system administration. Experience with: Logging and log analysis. Identity management principles and technology. Preferred but not required qualifications include: Bachelor-level university degree in a relevant field from an accredited university, or equivalent. CISSP, CISM, CISA, CIPP or other equivalent certification. Comprehensive knowledge of security design for networks, databases, infrastructure, and cloud computing. Experience writing security incident and vulnerability reports for leadership and other stakeholders. Ability to effectively communicate and influence secure product and network design in a collaborative environment. Comprehensive knowledge of digital forensics. Strong knowledge of web technologies, middleware, database, OS, firewalls, network communication protocols and methods. Knowledge of encryption technologies and architectures. Expert level experience in evaluating and assessing security threats across a variety of environments and industries. Expert level understanding of secure networking principles, routers, switches and load balancers.

As part of Oracle's employment process candidates will be required to successfully complete a pre-employment screening process. This will involve identity and employment verification, professional references, education verification and professional qualifications and memberships (if applicable).