• Create monthly reporting by analyzing and reporting on the effectiveness of IT security controls and risk exposure. • Assess and continuously monitor that all applicable regulatory requirements are met, and security controls are managed and maintained. • Perform information security risk evaluations on reported IT issues. • Advise and guide the business and IT partners on the appropriateness of security measures to mitigate risk and reduce risk exposure. • Educate the business and IT partners on alterative security measures where security requirements are unable to be met. • Track remediation plans through to successful implementation with the business and IT partners. • Participate in IT initiatives as necessary to ensure security control measures are addressed and imbedded in business-as-usual activities prior to project completion. • Develop information security processes and procedures and continuously improve security aspects of operating processes. • Serve as the primary point of contact for external auditors.