InfoSec Security Consultant 

Job summary 

As a Security Consultant within EYs internal Security Consulting and Assurance team, the individual will 
be a trusted advisor to EYs Audit Technologies portfolio.  Overarching responsibilities will include: direct 
engagement in delivery on programs and projects, defining security architectures, providing security 
guidance, identifying and prioritizing security-related requirements, promoting secure-by-default 
designs and facilitating delivery of information security services throughout the system development life 
cycle (SDLC). The role will also direct technology teams in the implementation of appropriate risk 
treatment and mitigation options to address security vulnerabilities.  Security Consultants are 
responsible for the translation of vulnerabilities into business risk terminology for communication to 
business stake holders. 

Essential functions of the job 

Define security architectures and provide pragmatic security guidance that balance business 
benefit and risks. 
Engage technology teams in order to evaluate and prescribe security controls at all 
touchpoints throughout the technology architecture 
Define security configuration standards for platforms and technologies 
Provide knowledge sharing and technical assistance to other team members 
Act as Subject Matter Expert (SME) in responsible technologies and have deep technical 
understanding of responsible portfolios 
Perform risk assessments of information systems and infrastructure 
Maintain and enhance the Information Security risk assessment methodology 
Develop appropriate risk treatment and mitigation options to address security risks identified 
during security review or audit 
Translate technical vulnerabilities into business risk terminology for business units and 
recommend corrective actions to customers and project stake-holders 

Knowledge and skills requirements 

Cloud technologies (MS Azure specifically) 
Strategic skills to analyze technology architectures and software solutions, identify security risk 
and prescribe mitigating security measures in accordance with the firms risk tolerance level. 
Five or more years working experience with the architecture, design and engineering of web-
based multi-tier information systems or network infrastructures 

Experience with security architecture, design and assessment of accounting and auditing 
systems. 
Ability to appropriately balance firm security needs with business impact & benefit 
Ability to facilitate compromise to incrementally advance security strategy and objectives 
An overall understanding of the business objectives of EY with an ability to build relationships 
with business partners and across EY IT 
Ability to team well with others to facilitate and enhance the understanding & compliance to 
security policies 
Experience facilitating meetings with multiple customers and technical staff, including building 
consensus and mediating compromise 
High degree of tolerance for ambiguity 
Experience conducting risk assessments, vulnerability assessments, vendor and third party risk 
assessments and recommending risk remediation strategies  
Experience working with common information security standards, such as: ISO 27001/27002, 
NIST, PCI DSS, ITIL, COBIT 

Job Requirements 

Education 
An advanced degree in Computer Science or a related discipline, or equivalent work experience 
Required Experience 
Five or more years of experience in security architecture, application security, networking, data 
center configuration, cloud technology, and the management of a significant Information 
Security risk functions 
5 or more years of experience in an Information Security or Information Technology discipline 
Experience in the Agile development lifecycle 
Experience in managing the communication of security findings and recommendations to IT 
project teams and management 
Exceptional judgment, tact, and decision-making ability 
Flexibility to adjust to multiple demands, shifting priorities, ambiguity, and rapid change 
Outstanding management, interpersonal, communication, organizational, and decision-making 
skills  
Strong English language skills are required 
Desired Experience 
Experience with cloud technology solutions, particularly MS Cloud 
Experience in technologies such as block chain, RPA, AI, etc. 
Knowledge of the Scaled Agile Framework 

Certification requirements 

It is preferred that candidates hold or be actively pursuing related professional certifications within 
the GIAC family of certifications or CISSP, CISM or CISA