Specialist I - Information Security

Job Description: Information Security Exception & Approval Management Analyst Job Band: A3–B2 Function: Information Security / Governance, Risk and Compliance Role Type: Full-time About the Role We are seeking a structured and detail-oriented Information Security Exception & Approval Management Analyst to manage the end-to-end lifecycle of security exception requests across the organization. This role is responsible for ensuring that deviations from approved security policies, standards, and controls are properly assessed, risk-reviewed, documented, approved, tracked, and periodically revalidated. The ideal candidate will work closely with business stakeholders, application owners, technology teams, privacy, compliance, and CISO leadership to enable informed risk-based decisions while supporting business objectives and maintaining alignment with organizational security expectations. Role Purpose The role exists to strengthen security governance by ensuring exception requests are evaluated consistently, supported by appropriate risk rationale, and governed through clear ownership, approval, monitoring, and closure practices. Key Responsibilities Exception Management and Risk Review • Review, validate, and process information security exception requests submitted by business and technology teams. • Assess business justification, risk impact, compensating controls, and remediation commitments before routing requests for approval. • Coordinate with relevant security, business, compliance, privacy, and technology stakeholders to support informed approval decisions. • Provide clear guidance to requestors on required documentation, approval workflows, and exception governance expectations. Lifecycle Governance and Monitoring • Maintain accurate records for security exceptions, including approval decisions, evidence, risk rationale, review dates, and ownership details. • Track exceptions through their full lifecycle, including approval, renewal, extension, remediation, expiry, and closure. • Monitor overdue, expired, high-risk, or recurring exceptions and follow up with stakeholders to drive timely action. • Support periodic reviews to confirm whether approved exceptions remain valid, justified, and aligned with risk tolerance. Reporting, Trends, and Continuous Improvement • Identify recurring exception themes, control gaps, risk concentration areas, and process improvement opportunities. • Prepare dashboards, metrics, and management reports covering exception aging, approval turnaround time, expired exceptions, renewal trends, and residual risk exposure. • Support automation, workflow improvement, and standardization of the exception management process. • Apply practical knowledge of cloud security, infrastructure security, application security, data protection, privacy, Required Qualifications and Experience • Bachelor’s degree in Information Security, Computer Science, Information Technology, Risk Management, or a related discipline. • 3–7 years of experience in information security, IT risk, GRC, compliance, or a related function. • Experience in managing or supporting security exceptions, risk acceptances, compensating control reviews, or compliance approval processes. • Working knowledge of security frameworks and standards such as ISO 27001, NIST, CIS Controls • Strong ability to assess risk, document rationale, manage stakeholder follow-ups, and support governance-driven decision-making. Preferred Certifications CRISC, ISO31000 , ISO 27001 Technical Skills • Exception management, risk acceptance, compensating control review, and governance documentation. • Information security domains including cloud security, infrastructure security, application security, identity and access management, data protection, and privacy. Tools and Platforms • Experience with GRC or IRM tools such as ServiceNow IRM/GRC, OneTrust, Archer, Hyperproof, MetricStream, or similar platforms. • Experience maintaining exception repositories, audit evidence, approval records, dashboards, and risk registers. • Familiarity with reporting and analytics tools such as Microsoft Excel, Power BI, or equivalent platforms. Key Competencies • Strong analytical thinking and risk-based decision support. • Clear written and verbal communication with the ability to explain risk and control expectations to technical and non-technical stakeholders. • Strong documentation discipline, attention to detail, and ability to maintain audit-ready records. • Ability to manage multiple priorities, follow up with stakeholders, and drive actions to closure. • Collaborative working style with the confidence to constructively challenge incomplete or weak business justifications. Ideal Candidate Profile The ideal candidate is a detail-oriented information security professional with practical experience in risk review, exception management, stakeholder coordination, and compliance documentation. The candidate should be able to balance business needs with security expectations, support timely decision-making, and maintain clear, accurate, and audit-ready records throughout the exception lifecycle.