information security manager

Starbucks Coffee Company

Job Description – information security manager ()

information security manager ( Job Number: )

Job Posting

Job Posting 25 Jan 2024 Unposting Date 8 Feb 2024

Location

Location UK-England-Chiswick

Is this role eligible for remote or hybrid work? Yes-Hybrid

Starbucks – Technology

Job Purpose and Mission

This position contributes to Starbucks success by implementing and supporting the planning and development, of the tactical as well as strategic technology security roadmaps. As the Information Security Manager, you’ll be responsible for leading and managing completion of security assessments and providing oversight of various security components, combining experience with security risk management methodologies and technology systems analysis to support the mission, vision, and values of the Global Cyber Security Services organisation in its role of protecting the Starbucks brand from security, compliance, and privacy threats. This role works cross-functionally with various business partners throughout Starbucks EMEA, GCS and International teams, engaging often and collaborating with their respective teams, fostering relationships to help drive security, privacy and IT compliance principles adopted by the organisation.

While supporting the delivery of the EMEA security roadmap, the Information Security Manager will partner with leadership, senior analysts, technical resources, and business partners in the delivery of meaningful technology security solutions, processes, and services. Models and acts in accordance with Starbucks guiding principles.

Summary of Key Responsibilities

• Support the EMEA information security team management in key interactions with markets, vendors, regional teams, and technology leadership across Starbucks EMEA above store operations, omni channels, and compliance related activities.
• Responsible for successful execution of strategic and tactical roadmaps for EMEA above store areas to ensure alignment and collaboration in the delivery of security objectives across, internal and external partners.
• Responsible for security risk assessments in support of business requirements related to EMEA technology security roadmap and all above store areas.
• Identifies areas and opportunities to innovate and introduce new technologies to derive efficient and cost-effective security components within Starbucks Digital Services and Starbucks EMEA
• Responsible for building and implementing procedural documentation and workflows (e.g. process flows & SOP’s) in support of technology security risk programs.
• Responsible for providing oversight on vulnerability management, security pen-testing and control assessments across all the above store areas including creation of actionable reports on findings to the team and management stakeholders.
• Responsible for security architecture guidance on AOP and non-AOP objectives
• Maintains and reviews reports from security monitoring systems, tracking, and reacting to variances to established baselines, and reporting on trends; presents opportunities for improvement.
• Identifies, reports, and advises on resolution of privacy, compliance or technology security risks and control gaps.
• Management of EMEA specific technology security processes, documentation, and communications.
• Manages technology security control exceptions or deficiencies tracking and monitoring, assisting with remediation development.
• Responsible for execution of the tactical roadmap that supports the planning, development, and driving the implementation of technology security awareness and education campaigns to encourage adoption of policy, procedures, standards, or guidelines across Starbucks EMEA business units.
• Leads implementation of goal-based technology security metrics models across all capability areas within EMEA
• Responsible for monitoring adherence to key SLA’s, KPI, KRIs and KGI’s
• Responsible for 3rd party risk assessments and vendor security oversight program for EMEA above store areas.
• Defining and driving the Monthly Security Risk Profile and Performance Dashboard for EMEA above store pillars.
• Responsible for identifying opportunities for the upskilling and training requirements for direct reports
• Responsible in aligning technology AOP to security requirements and resources

Required Knowledge, Skills and Abilities

• Significant IT Security Risk Management experience
• Certifications such as CISSP, CCSP or others focused on IT Security, highly desired
• Knowledge of Security Architecture principles, ISO Standards and PCI DSS
• Ability to collaborate across teams, both internal and external to GCS, fostering engagement and building relationships
• Demonstrated ability to improve individual job skills through training, self-research, and self-study
• Knowledge of and ability to apply process improvement principles
• Ability to work in a dynamic work environment, handle ambiguity and maintain productivity
• Ability to communicate clearly and concisely, both verbally and in writing, active listening skills
• Ability to plan, organize and prioritize tasks and provide guidance to others
• Experience developing or enhancing existing technology security processes, or developing continuous controls monitoring processes
• Experience with infrastructure and digital vulnerability management, preferred
• Strong skills in Microsoft Word, Excel, and PowerPoint
• Strong knowledge of commonly used risk principles, practices, and concepts such as vulnerability management, threat assessment & modelling (e.g. STRIDE), and control effectiveness measurement
• Knowledge of developing process improvement models, preferred
• Knowledge of assessing, developing, or executing to a management framework such as ISO 27001, PCI & NIST CSF preferred
• Ability to use calibrated estimation or similar measurement models, preferred
• Retail solutions knowledge e.g. mobile apps, ePOS and other (preferred, not essential)

This job description is only a summary of the typical functions of the role and is not an exhaustive or comprehensive list of all possible responsibilities, tasks, and duties that may be required. Management reserves the right to amend the responsibilities, tasks, and duties of the jobholder as dictated by business requirements.

Starbucks is committed to building an inclusive and diverse workforce . All applicants and partners will be treated fairly, without regard to race, religion, sex, nationality, age, physical or mental disability, sexual orientation, marital status, gender identity and expression.