Director, Security Assurance and Remediation

About CLS

CLS is the trusted party at the centre of the global FX ecosystem. Utilized by thousands of counter parties, CLS makes FX safer, smoother and more cost effective. Trillions of dollars' worth of currency flows through our systems each day.

Created by the market for the market, our unrivalled global settlement infrastructure reduces systemic risk and provides standardization for participants in many of the world's most actively traded currencies. We deliver huge efficiencies and savings for our clients: in fact, our approach to multilateral netting shrinks funding requirements by over 96% on average, so clients can put their capital and resources to better use.

CLS products are designed to enable clients to manage risk most effectively across the full FX lifecycle - whether through more efficient processing tools or market intelligence derived from the largest single source of FX executed data available to the market.

• Pivotal purpose
• Trusted guardian
• Targeted innovation
• Facilitate connections
• Delivering excellence
• Inclusive culture

The role is responsible for leading and enforcing Security assurance, remediation, and monitoring across the organization's environment. This role focuses on ensuring compliance with security standards and controls, developing, maintaining and monitoring against a consolidated remediation roadmap to drive improvements that reduce security risk to an acceptable level. The individual will oversee security risk reduction reporting, maintaining strong security risk practices and rigour within the team and be a security champion driving a positive risk culture across the organisation.

The position will require close collaboration with technical, operational, compliance and audit teams to create a secure and compliant technology environment.

• Develop, maintain security remediation oversight, and conduct reviews across all CLS environments, services, and assets, ensuring compliance with industry standards (e.g., CIS, NIST, ISO 27001, SOC 1/2) and internal security policies across all platforms and environments.
• Lead the security governance mechanism for capturing and managing security baseline adherence to rectify any policy exceptions and dispensations (deviations or gaps) against the security policy standards and controls and align security risks.
• Oversee the remediation review lifecycle, testing of evidence related to remediation plans, producing regular reporting at relevant levels confirming direction of travel of risk improvement or decline.
• Collaborate with security and IT teams on monitoring vulnerability and patch management progress against standards and controls guidelines, with oversight of remediation and timing to reduce risk to an acceptable level.
• Direct, coach and rollout training for team to understanding security gaps and providing evaluation, treatment options and consultation on remediation approaches to address gaps and continue ongoing monitoring of remediation, re‑assess and closure of from evaluations.
• Own and manage central repositories of evidence and security artefacts that support multiple internal and external audits and regulatory requirements.
• Stay updated on advancements in security technologies, policies, and regulatory changes, recommending and implementing necessary improvements.
• Key member of the function who regularly reviews Security Policies, Standards and Controls and optimize position on areas associated to regulations and company strategy.
• Integrate processes with Cyber Threat Intelligence to ensure appropriate monitoring of the threat landscape for emerging security risks and ensure swift response to zero‑day threats.
• Collaborating on Security Risk Management strategies, aligning to 3 lines of defence model and enforcing alignment of risk taxonomy to organizational cybersecurity risk management processes, procedures and activities are identified across all security functions.

• Leads by Example: Demonstrates the technical and professional skills expected across the global team through personal action.
• Accountable and effective communicator: Clearly takes charge of the duties outlined above and communicates well with stakeholders so teams can operate in unison where required.
• Innovator and Change Agent: Always striving to find ways to automate existing processes, streamline and simplify complexity, and incorporate new ideas and capabilities to enhance our security posture and make the team stronger and better.
• Decisive: provides clear direction during cyber incident response to the Security Operations team and all associated stakeholders.
• Identify risks
  :
  Able to synthesize capability gaps and articulate them so the Firm can manage risk in alignment with its risk management strategy.
• Manages ambiguity: operating effectively and decisively, even when things are not certain, or the way forward is unclear.
• Collaborates: building partnerships and working collaboratively with others to meet shared…