Director, Security Assurance and Remediation

About CLS:

CLS is the trusted party at the centre of the global FX ecosystem.  Utilized by thousands of counterparties, CLS makes FX safer, smoother and more cost effective.  Trillions of dollars’ worth of currency flows through our systems each day. 

Created by the market for the market, our unrivalled global settlement infrastructure reduces systemic risk and provides standardization for participants in many of the world’s most actively traded currencies.  We deliver huge efficiencies and savings for our clients: in fact, our approach to multilateral netting shrinks funding requirements by over 96% on average, so clients can put their capital and resources to better use.

CLS products are designed to enable clients to manage risk most effectively across the full FX lifecycle – whether through more efficient processing tools or market intelligence derived from the largest single source of FX executed data available to the market.

Our ambition to make a positive difference starts with our people.  Our values – Protect, Improve, Grow – underpin everything that we do at CLS and define and shape a supportive and inclusive working environment in which everyone is encouraged to be open and forward-thinking.

Job purpose, major duties, and responsibilities of the job

The role is responsible for leading and enforcing Security assurance, remediation, and monitoring across the organization’s environment. This role focuses on ensuring compliance with security standards and controls, developing, maintain and monitor against a consolidated remediation roadmap to drive improvements that reduce security risk to an acceptable level. The individual will oversee security risk reduction reporting, maintaining strong security risk practices and rigour within the team and be a security champion driving a positive risk culture across the organisation. The position will require close collaboration with technical, operational, compliance and audit teams to create a secure and compliant technology environment.

• Develop, maintain security remediation oversight, and conduct reviews across all CLS environments, services, and assets, ensuring compliance with industry standards (e.g., CIS, NIST, ISO 27001, SOC 1/2) and internal security policies across all platforms and environments.
• Lead the security governance mechanism for capturing and managing security baseline adherence to rectify any policy exceptions and dispensations (deviations or gaps) against the security policy standards and controls and align security risks.
• Oversee the remediation review lifecycle, testing of evidence related to remediation plans, producing regular reporting at relevant levels confirming direction of travel of risk improvement or decline.
• Collaborate with security and IT teams on monitoring vulnerability and patch management progress against standards and controls guidelines, with oversight of remediation and timing to reduce risk to an acceptable level.
• Direct, coach and rollout training for team to understanding security gaps and providing evaluation, treatment options and consultation on remediation approaches to address gaps and continue ongoing monitoring of remediation, re-assess and closure of from evaluations.
• Own and manage central repositories of evidence and security artefacts that support multiple internal and external audits and regulatory requirements.
• Stay updated on advancements in security technologies, policies, and regulatory changes, recommending and implementing necessary improvements.
• Key member of the function who regularly reviews Security Policies, Standards and Controls and optimize position on areas associated to regulations and company strategy.
• Integrate processes with Cyber Threat Intelligence to ensure appropriate monitoring of the threat landscape for emerging security risks and ensure swift response to zero-day threats.

• Collaborating on Security Risk Management strategies, aligning toa 3 lines of defence model and enforcing alignment of risk taxonomy to organizational cybersecurity risk management processes, procedures and activities are identified across all security functions.

Leadership

• Leads by Example: Demonstrates the technical and professional skills expected across the global team through personal action.
• Accountable and effective communicator: Clearly takes charge of the duties outlined above and communicates well with stakeholders so teams can operate in unison where required.
• Innovator and Change Agent: Always striving to find ways to automate existing processes, streamline and simplify complexity, and incorporate new ideas and capabilities to enhance our security posture and make the team stronger and better.
• Decisive: provides clear direction during cyber incident response to the Security Operations team and all associated stakeholders.
• Identify risks: Able to synthesize capability gaps and articulate them so the Firm can manage risk in alignment with its risk management strategy.
• Manages ambiguity: operating effectively and decisively, even when things are not certain, or the way forward is unclear.
• Collaborates: building partnerships and working collaboratively with others to meet shared objectives.
• Influence: proven success navigating and operating effectively in a matrix organization.
• Customer focus: building strong partnerships and delivering customer-centric solutions.
• Committed to professional development with a personal appetite to grow and contribute further to the organization over time.

Knowledge, Skills, and abilities

• Bachelor’s degree in computer science, Cybersecurity, Information Technology, or related field. Master’s degree preferred.
• CRISC, CISM, CISA, CDPSE, or similar advanced security certifications.
• Advantageous to have experience in Artificial Intelligence, post quantum computing and cyber risk quantification.
• Considerable experience in cybersecurity, with notable experience in a senior or managerial role focused on security policy, standards, controls testing, governance, and compliance.
• Mastery experience of how security controls are implemented, their effectiveness, and alignment with security policy, standards and NIST best practice guidelines.
• Strong ability to consult with control owners on their security remediation implementations and provide insights on evidence provision required to be compliant.
• Proficient on security data analysis, identify trends and areas for improvement.
• Expert in technical writing reports and documenting risk assessment findings and mitigation plans clearly and accurately.
• Excellent verbal and written communication skills to convey complex technical information clearly and effectively. Presenting data insights to non-technical stakeholders
• Strong understanding of security risk management and taxonomy principles, to reduce risk to an acceptable level.
• Experience with GRC tools and best practices. RSA Archer is preferred.
• Proficiency in security frameworks (e.g., NIST CSF, ISO 27001, SOC1,2).
• Expert knowledge of security assurance practices such as audit, risk assessing, associated lifecycles and key management practices.
• In an ever-changing cyber landscape to be able to lead a team to adapt to changes in line with organisation needs but also in line with the threat landscape.
• High level of integrity and ethical judgement to handle sensitive information responsibly.
• Familiarity with cloud security controls and securing hybrid IT environments.
• Knowledge of vulnerability management and incident management practices.
• Evidence of working in the Financial Service Industry preferred.

Our commitment to employees:

At CLS, we celebrate diversity and consider this to be one of our strongest assets. We are committed to fostering an environment in which everyone feels comfortable to be who they are, and inclusion is valued. All employees have access to our inclusive benefits, including:

• Holiday - UK/Asia: 25 holiday days and 3 ‘life days’ (in addition to bank holidays). US: 23 holiday days.
• 2 paid volunteer days so that you can actively support causes within your community that are important to you.
• Generous parental leave policies to ensure you can enjoy valuable time with your family.
• Parental transition coaching programmes and support services.
• Wellbeing and mental health support resources to ensure you are looking after yourself, and able to support others.
• Affinity Groups (including our Women’s Forum, Black Employee Network and Pride Network) in support of our organisational commitment to embrace and always be learning more about DE&I.
• Hybrid working to promote a healthy work/life balance, enabling employees to work collaboratively in the office when needed and work from home when they don’t.
• Active support of flexible working for all employees where possible.
• Monthly ‘Heads Down Days’ with no meetings across the whole company.
• Generous non-contributory pension provision for UK/Asia employees, and 401K match from CLS for US employees.
• Private medical insurance and dental coverage.
• Social events that give you opportunities to meet new people and broaden your network across the organisation.
• Annual flu vaccinations.
• Discounts and savings and cashback across a wide range of categories including health and retail for UK employees.
• Discounted Gym membership – Complete Body Gym Discount/Sweat equity program for US employees.
• All employees have access to Discover – our comprehensive learning platform with 1000+ courses from LinkedIn Learning.
• Access to frequent development sessions on a number of topics to help you be successful and develop your career at CLS.