Business Information Security Officer

Overview Are you interested in partnering with technology leaders and supported business areas to provide thought leadership and information security guidance on a wide array of business strategy objectives for a fortune 200 company? If so, then we are looking for you! We are currently seeking a highly motivated to join our IT Risk Management team in Richmond, VA as a Business Information Security Officer - BISO. The successful candidate will function in this role to support various business services and operating companies. We are open to remote working arrangements. Responsibilities Include: • Representing the Chief Information Security Officer (CISO) to Altria’s business lines and/or operating companies, delivering comprehensive risk assessment and mitigation strategies crafted to improve the overall cybersecurity posture of the company. • Coordinating the delivery of cyber service(s) to improve risk understanding and cyber-strategies across the enterprise. • Briefing business executives on cybersecurity threats, initiatives, open risks, and serving as a liaison to capture information on technology strategies within support business lines • Interpreting information security policies, standards (i.e. NIST, CIS, OWASP, etc.), and other requirements with respect to specific internal information systems and assisting with the implementation of these and other information security requirements. • Providing business and technical advice on a variety of IT risk issues, concerns, problems, and projects ensuring all business processes incorporate adequate information security • Developing and communicating security and compliance requirements to technology and system owners and key business partners in support of business-area initiatives • Providing users and management with security guidance for selecting technology products, as well as ongoing integrations and improvements of such products • Assessing and qualifying risk related to third party service providers and supporting the Supplier Risk Management program, including driving remediation of findings and supporting contract negotiations. • Providing support for the Threat and Vulnerability Management program, including web application security, in-house IT environments and cloud-based infrastructure. Driving risk insights via reporting in support of effective vulnerability management. • Serving as a technical leader for periodic information system and application risk assessments, including those associated with the development of new or significantly improved business applications. • Monitoring current and proposed laws, regulations, industry standards and ethical requirements related to IT risk, information security and privacy • Providing support for internal security assessments and corporate audit assessments, including active engagement in high-risk auditable areas, risk management, remediation of audit findings, and ongoing information security governance. • Serving as the SME for technology operating in the supported business lines, establishing strong working relationships with IT professionals supporting those systems, and supporting effective incident response in conjunction with Altria’s internal Computer Security Incident Response Team (CSIRT) Key Qualifications: • Bachelor's degree in Computer Science, Information Systems, Engineering or related subject area • 8+ years of IT experience with 5+ years in an IT risk or information security role. • Broad knowledge of IT technologies, operating systems, application platforms and emerging technology. • Detailed understanding of IT information security fundamentals, risk assessment and risk management fundamentals, defense-in-depth practices, modern networking technologies and IT security controls. • Agile development practices (e.g. SecDevOps) • Payment Card Industry Data Security Standard (PCI DSS) compliance • NIST security controls frameworks, including the NIST Cyber Security Framework • Excellent verbal and written communication and interpersonal skills. • Certified Information System Security Professional (CISSP), Certified Information System Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), or similar certification desired. Company Overview Altria has a leading portfolio of tobacco products for U.S. tobacco consumers age 21+. Altria’s Vision through 2030 is to responsibly lead the transition of adult smokers to a non-combustible future. Altria is Moving Beyond Smoking™, leading the way in moving adult smokers away from cigarettes by taking action to transition millions to potentially less harmful choices - believing it is a substantial opportunity for adult tobacco consumers, Altria’s businesses and society. Altria’s wholly owned subsidiaries include the most profitable tobacco companies in their categories: Philip Morris USA Inc. (PM USA), U.S. Smokeless Tobacco Company LLC (USSTC), and John Middleton Co. (Middleton). Altria’s smoke-free portfolio includes Helix Innovations LLC (Helix), the maker of on! oral nicotine pouches, exclusive U.S. commercialization rights to the IQOS Tobacco Heating System®* and Marlboro HeatSticks®*, and an equity investment in JUUL Labs, Inc. (JUUL). Altria also owns equity investments in Anheuser-Busch InBev SA/NV (ABI), the world’s largest brewer, and Cronos Group Inc. (Cronos), a leading Canadian cannabinoid company. At Altria, we celebrate the power of diverse teams working together to shape our future. We are inspired to bring our best because our unique strengths are valued. We believe our personal success and progress should be guided by Our Cultural Aspiration, a new articulation of what we value and who we aspire to be, collectively. Our Cultural Aspiration respects and complements individual identity, embracing each other’s unique strengths, welcoming newcomers and developing the best, most inclusive and diverse teams. Join us as we work together to shape a better future for adult tobacco consumers, our employees, and our shareholders. Each Altria company is an equal opportunity employer. Learn more about Altria at www.altria.com and follow us on Twitter, Facebook and LinkedIn. *IQOS Devices and HeatSticks® are currently unavailable for sale in the United States.