Asurion

Question 1

The Technology Audit & Compliance Architect will design and implement programs to ensure compliance with regulatory and contractual requirements and industry standards (to include HIPAA and PCI) for Asurion, globally. Responsibilities include leading security-related technology audits to drive compliance and alignment of technology resources.

Question 2

As part of our Trust Office team, you will work to ensure that our systems and services are designed, operated, and protected to maintain customer trust and regulatory compliance.

Question 3

You will partner with stakeholders across Asurion to execute a risk management approach, identify risks, and act as a thought leader who recommends and leads risk mitigation strategies with cross-functional teams across Asurion.

Question 4

You will work independently with the ability to prioritize workloads, remain flexible, and maintain a strong attention to detail in a fast-paced environment while supporting multiple, simultaneous programs.

Question 5

Essential duties & responsibilities:

Answer 5

Use your in-depth knowledge of regulatory compliance, IT security, and strong customer skills to act as the subject matter expert to internal technology and operations teams in a Trusted Advisor capacity to assist their understanding of requirements (i.e. HIPAA, PCI, etc) related to their applications.
Develop the HIPAA compliance program from risk identification to executive reporting.
Conduct and complete pro-active HIPAA assessments on behalf of the company to ensure the company’s ability to protect PHI data.
Lead regulatory remediation projects and risk mitigation efforts. Track and manage action plans for remediation of audit findings. Perform analysis and reporting of compliance gaps.
Provide subject matter expertise related to PCI, HIPAA or client security requirements to internal technology and operations teams to ensure Company’s ability to maintain compliance when modifying or implementing applications involving sensitive data.
Implement best in class Risk & Compliance Management practices with minimal impact to the business.
Lead Asurion’s response to client audit requests and coordinate collection of audit artifacts.
Monitor issues to provide assurance reporting of how Company is complying with specific country and industry regulatory requirements and the internal control framework in order to maintain a compliant, audit-ready posture.
Coordinate and represent Asurion in negotiations with external auditors.
Train audit participants in audit preparation and response.

Question 6

Education and/or formal training:

Answer 6

BS/BA Computer Science or equivalent work experience
Must currently hold one or more of the following security certifications:
o CISSP or CISM

Must currently hold one or more of the following audit certifications:
o CISA, GSNA, IRCA, ISMS Auditor, or Certified ISO 27001 Lead/Internal Auditor

PCI QSA or ISA certification desirable

Question 7

Here’s what you’ll bring to the team:

Answer 7

5+ years progressive experience in information security or technology audit, including experience with issue resolution and leading teams in a cross-functional setting.
Experience in technology audit, risk analysis, and compliance testing.
Good working knowledge of security regulations and industry best practices.
In-depth knowledge of HIPAA and demonstrated experience with HIPAA program development
5+ years leading global regulatory compliance efforts (e.g. HIPAA, PCI, SOX, Privacy).
Experience evaluating the design and effectiveness of IT controls.
Knowledge of auditing frameworks and international standards, such as ISO 27001/27002, PCI DSS, HIPAA/HITRUST, SSAE 18, COBIT and ITIL.
Experience or familiarity with governance, risk and compliance (GRC) tools such as ServiceNow.
Strong analytical and problem resolution skills. Exceptional business judgment, with the ability to think strategically and give practical advice by balancing business needs with risks.
Broad and deep technical knowledge across multiple, diverse technical configurations, technologies and processing environments.
Exceptional interpersonal skills in areas such as teamwork, collaboration, facilitation, negotiation, and persuasiveness.
Excellent communication (oral, written, presentation) skills. Ability to communicate effectively at all levels of the organization.
A practiced ability to influence peers, customers and project teams to make security-minded decisions and changes.
Must be self-directed, organized and have excellent time management skills.
Ability to work in a fast-paced, dynamic environment while maintaining high quality output and a positive working relationship with peers and management.
Ability to operate under ambiguous circumstances, address uncomfortable issues, and leverage data to make informed decisions.

Question 8

Other position considerations:

Answer 8

Required to read and follow all company policies and procedures.
Ability to handle proprietary and sensitive information in a confidential manner.
While the schedule is generally a Monday through Friday daily schedule, this position may require some weekend and evening assignments as well as availability during off-hours for participation in scheduled and unscheduled activities.
May involve travel up to 10% of the time.

Question 9

Our aim is to continually evolve our privacy program by finding strategies, processes and mechanisms that scale across geographies and our various businesses and functions in a manageable, repeatable way.

Question 10

Asurion’s privacy team focuses on delivering sound risk management and outputs that demonstrate compliance and accountability.

Answer 10

1. “Is the corporation’s compliance program well designed?“
2. “Is the program being applied earnestly and in good faith?“ In other words, is the program adequately resourced and empowered to function effectively?
3. “Does the corporation’s compliance program work“ in practice?

Question 11

Serve as a privacy, compliance, and data protection expert and a primary point of contact for customers and colleagues.

Question 12

Collaborate with the Privacy Team, Trust Office, legal department, and multiple partners in other business functions to build a resilient, scalable privacy program that works for a fast-growing, innovative company.

Question 13

Develop a deep understanding of data usage across Asurion products and business functions.

Answer 13

Data Map

HIPAA map
Healthcare data map

Question 14

Identify legal and operational privacy and data protection concerns and furnish efficient solutions.

Answer 14

HIPAA
HITECH
GDPR
CCPA
HR 8?

45 CFR § 164.504 - Uses and disclosures: Organizational requirements.

Question 15

Our best work enables Asurion to nimbly and confidently adapt to the fast-coming changes in privacy laws around the world. This requires comfort with stepping into complex problems that lack easy “by the book” solutions and finding practical paths forward both legally and operationally.

Question 16

Work with key business stakeholders to complete Privacy Impact Assessments and other privacy reviews related to products, technologies, and vendors.

Question 17

Guide product and development teams to ensure that their data collection and usage practices are transparent, protect user privacy, and mitigate risk.

Question 18

Identify and escalate potential privacy and data protection concerns based upon risk and operational impact.

Question 19

Engage and support the legal department in negotiation of privacy and data protection-relevant contract terms for both clients and vendors.

Question 20

Support the Trust Office, security and legal teams in driving effective and risk-minimizing responses to information security events.

Question 21

Support response to individuals exercising their rights under global data privacy laws.

Question 22

Facilitate compliance with privacy and data protection laws by Asurion’s global affiliates.

Question 23

Provide timely and accurate responses to customer and internal queries related to privacy and data protection.

Question 24

Seek to identify synergies and “force multipliers” with the Data Governance and Audit & Compliance arms of the Trust Office.

Question 25

Support vendor risk management functions with emphasis on privacy, compliance, and data ethics.

Question 26

Collaborate on development of education and engagement strategy and actively engage business stakeholders with practical, actionable information that multiplies the impact of our program.

Question 27

Continuously seek to develop, improve and streamline efficient, scalable and resilient privacy and data protection processes, tools and procedures, including maintaining useful documentation of them.

Question 28

Monitor legal and regulatory developments, the privacy practices of peer companies, relevant privacy and data protection frameworks and best practices in general.

Question 29

Identify evolving privacy risks inherent in Asurion’s operations and in the development of new products and services.

Question 30

Must be comfortable getting “elbow-to-elbow” with other business functions understand intersection of our products, services and business functions to develop deep grasp of how privacy and data protection requirements apply to Asurion.

Question 31

This position will report to the Asurion Privacy Team and the Asurion Trust Office of which the Privacy Team is a part. Because job responsibilities will include being a key liaison and partner with the Asurion legal team, we are seeking an attorney with approximately 2-4 years of privacy and/or security experience for the role.

Question 32

Must be comfortable multi-tasking and working in a fast-paced dynamic environment.

Question 33

Collaborative, humble team-first approach to innovate and solve problems at a pace that keeps up with Asurion’s innovation and growth, sometimes in areas where there is no clear, well-defined path.

Question 34

Ability to communicate technical and legal concepts to laypeople with impact and effect without relying on legal and technical jargon.

Question 35

Must maintain composure under pressure and have a high degree of perseverance.

Question 36

High integrity and ethical standards are non-negotiable.

Question 37

Excellent communication skills, both written and oral.

Question 38

Comfort with public speaking and educating non-specialists in privacy and data protection matters.

Question 39

Strong analytical and problem-solving skills.

Question 40

Must be energized by taking on big challenges and have fun doing it.

Question 41

The Technology Audit & Compliance Architect will design and implement programs to ensure compliance with regulatory and contractual requirements and industry standards (to include HIPAA and PCI) for Asurion, globally.

Question 42

Responsibilities include leading security-related technology audits to drive compliance and alignment of technologyresources.

Question 43

As part of our Trust Office team, you will work to ensure that our systems and services are designed, operated, and protected to maintain customer trust and regulatory compliance.

Question 44

You will leverage your background in audit, security, risk, and compliance to evaluate and assess systems and services against Asurion policies and standards.

Question 45

You will partner with stakeholders across Asurion to execute a risk management approach, identify risks, and act as a thought leader who recommends and leads risk mitigation strategies with cross-functional teams across Asurion.

Question 46

A data classification policy describes the data classification categories; level of protection to be provided for each category of data; and roles and responsibilities of potential users, including data owners.

Question 47

You will work independently with the ability to prioritize workloads, remain flexible, and maintain a strong attention to detail in a fast-paced environmentwhilesupportingmultiple, simultaneous programs.

Question 48

Use your in-depth knowledge of regulatory compliance, IT security, and strong customer skills to act as the subject matter expert to internal technology and operations teams in a Trusted Advisor capacity to assist their understanding of requirements (i.e. HIPAA, PCI, etc) related to their applications.

Question 49

Develop the HIPAA compliance program from risk identification to executive reporting.

Question 50

Conduct and complete pro-active HIPAA assessments on behalf of the company to ensure the company’s ability to protect PHI data.

Question 51

Lead regulatory remediation projects and risk mitigation efforts.

Question 52

Track and manage action plans for remediation of audit findings.

Question 53

Perform analysis and reporting of compliance gaps.

Question 54

Provide subject matter expertise related to PCI, HIPAA or client security requirements to internal technology and operations teams to ensure Company’s ability to maintain compliance when modifying or implementing applications involving sensitive data.

Question 55

Implement best in class Risk & Compliance Management practices with minimal impact to the business.

Question 56

Lead Asurion’s response to client audit requests and coordinate collection of audit artifacts.

Question 57

Monitor issues to provide assurance reporting of how Company is complying with specific country and industry regulatory requirements and the internal control framework in order to maintain a compliant, audit-ready posture.

Question 58

Coordinate and represent Asurion in negotiations with external auditors.

Question 59

Train audit participants in audit preparation and response.

Question 60

5+ years progressive experience in information security or technology audit, including experience with issue resolution and leading teams in a cross-functional setting.

Question 61

Experience in technology audit, risk analysis, and compliance testing.