Senior Analyst Cybersecurity Risk Management

Since 1869 we've connected people through food they love. We're proud to be stewards of amazing brands that people trust. Our portfolio includes the iconic Campbell's brand, as well as Michael Angelo's, Pace, Pacific Foods, Prego, Rao's Homemade, Swanson, and V8. In our Snacks division, we have brands like Cape Cod, Goldfish, Kettle Brand, Lance, Late July, Pepperidge Farm, Snack Factory, and Snyder's of Hanover.

Here, you will make a difference every day. You will be supported to build a rewarding career with opportunities to grow, innovate and inspire. Make history with us.

Why Campbell's...

• Benefits begin on day one and include medical, dental, short and long-term disability, AD&D, and life insurance (for individual, families, and domestic partners).
• Employees are eligible for our matching 401(k) plan and can enroll on the first day of employment with immediate vesting.
• Campbell's offers unlimited sick time along with paid time off and holiday pay.
• If in WHQ - free access to the fitness center. Access to on-site day care (operated by Bright Horizons) and company store.
• Giving back to the communities where our employees work and live is very important to Campbell's. Our "Campbell's Cares" program matches employee donations and/or volunteer activity up to $1,500 annually.
• Campbell's has a variety of Employee Resource Groups (ERGs) to support employees.

How you will make history here...

The Senior Analyst, Cybersecurity Risk Management will be part of a cross-functional team to ensure information security and business alignment. This role will work closely with the lines of business to understand their strategic and operational needs, identify and evaluate the associated risk, and determine policy and/or technical controls that will mitigate overall risk to the Company and drive business value.

What you will do...

• Partner with the IT Service Manager and the line of business to develop an understanding of organization's business operations and strategic vision.
• Evaluate the operations and strategic plan to identify potential security and privacy requirements, challenges and concerns in order to proactively advise on security and privacy risks to be considered as part of planning.
• Partner with Information Security Architects, Information Assurance and Compliance, Incident Management and other IT Stakeholders to ensure that security controls are designed and implemented effectively. This may include ensuring appropriate testing of applications prior to launch, including SecDevOPS and pentesting.
• Partner with business teams to identify, document, assess and mitigate existing and emerging cyber security risks based on the sensitivity level of data in use, control of the data internally and externally, and unique needs of the business unit.
• Conduct periodic assessments of data protection controls and security measures to validate their effectiveness and identify areas for improvement.
• Collaborate with business units and data owners to identify and document data flows, usage patterns, and access controls as per Campbell's data classification requirements. This entails categorizing data based on its sensitivity, criticality, and regulatory requirements.

• Establish the organizational tolerance for risk and communicate the risk tolerance throughout the organization including guidance on how risk tolerance impacts ongoing decision-making activities.
• Identify and partner with Information Security Policy/Awareness analyst to identify role based training including educating business unit teams on identifying cyber security risks in day-to-day operations.
• Remain current about current security threats, events and breaches in the industry specific to the line of business in order to ensure that control frameworks are future-proofed as best as possible.
• Analyze business requirements that could require unique/specific security controls such as those related to Internet of Things (IoT), Big Data etc.
• Partner with Information Security Compliance, Chief Privacy Officer and others to identify compliance requirements such as PCI, GDPR/CCPA, SOX etc.
• Perform documented risk assessments of business projects that include review of functionality, architecture, data mapping, third party assessment, policy and operations controls. Obtain executive sign off as appropriate.
• Review audit and other independent assessments to ensure that recommended controls are appropriate based on risk tolerance/acceptance procedures.

What you bring to the table...

• Recommended Security certifications CISA, CISM, CISSP, SANS, etc
• Bachelor's degree required.
• 5+ years of experience required in the following areas:
• Previous Information Security or Risk Management experience in a large, complex environment.
• Previous Information Security or Risk Management experience in a manufacturing organization or exposure to Operational Technology preferred but not required.
• Strong proficiency with cybersecurity management frameworks including NIST Cybersecurity Framework, NIST 800-53, NIST 800-171, IS27001 and compliance requirements such as GDPR, SOX, PCI.
• Experience as a consultant and/or trusted business advisor.
• Demonstrated strong knowledge of networks, desktops, servers, cloud and software as a service technology.
• Demonstrated experience in incorporating data protection controls into technological systems and infrastructure.
• Demonstrated ability to identify and evaluate risk in accordance with the company and business unit's overall risk tolerance.
• Proven ability to communicate complex and technical issues to diverse audiences, orally and in writing, in an easily-understood and actionable manner in a way that consistently drives objective decisions about risk in order to optimize the trade-off between risk mitigation and business performance.
• Proven ability to understand business requirements and commitment to delivering high-quality, prompt, and efficient service to the business.
• An ability to effectively coach, influence and convince others to make appropriate changes in their priorities and behaviors for the benefit of the organization.
• An ability to communicate risks to employees outside Information Security in a way that consistently drives objective decisions about risk in order to optimize the trade-off between risk mitigation and business performance.
• Strong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one.
• Demonstrated connections to information risk managers external to the Company and learning organizations.
• Excellent prioritization capabilities, with an aptitude for breaking down work into manageable parts, effectively assessing the priority and time required to complete each part.

Compensation and Benefits:

The target base salary range for this full-time, salaried position is between

Individual base pay depends on work location and additional factors such as experience, job-related skills, and relevant education or training. Total pay may include other forms of compensation. In addition, we offer competitive health, dental, 401k and wellness benefits beginning on the first day of employment. Please ask your Talent Acquisition Partner for more information about our total rewards package.

The Company is committed to providing equal opportunity for employees and qualified applicants in all aspects of the employment relationship, including consideration for employment, without regard to race, color, sex, sexual orientation, gender identity, national origin, citizenship, marital status, protected veteran status, disability, age, religion, or any other classification protected by law.