Associate Director, Regulatory Risk, Compliance & Accreditation

Purpose

• The Associate Director will serve as an Information Security & Technology (IS&T) Program Expert

• and Accreditor for the PPFA Accreditation & Certification Program, which works to assess and
• manage risks across the federation through routine evaluation of its affiliate and ancillary
• organizations.

• The Associate Director is also responsible for PCI DSS compliance activities across

• the federation, which ensures that relevant internal controls are assessed and meet established
• information security, regulatory, operational, and reporting policies, regulations, and guidelines,
• while also providing support to the Third Party Risk Management (TPRM) Program, as needed.

Engagement

• The Associate Director will be part of the HIPAA, Risk & Compliance team.
• This role will engage with the Information Security team, team members across the broader TSS division, the Accreditation &Evaluation Department (AED) team, Development, Finance, Office of the General Counsel and third party vendors.
• This role will engage with the executive and operational staff within the PPFA National Office, affiliates,

and ancillary organizations.

Delivery

• The Associate Director will deliver by evaluating security and technology systems, controls, and

• policies of affiliate and ancillary organizations, write reports that interpret assessment results and
• enumerate any findings, develop and track corrective actions, and assess efficacy of risk mitigation
• activities performed by the affiliate or ancillary organization.

• The Associate Director will deliver by

• conducting PCI DSS compliance activities utilizing assessment tools to ensure regulatory
• compliance and risk management across the federation.

• Conducts Accreditation and Certification interviews, risk assessments, and technical analyses

• to determine areas of risk and non-compliance with defined IS&T criteria aligned to cyber
• security frameworks (NIST CSF) and regulatory requirements (HIPAA Security, PCI DSS).

• Conducts Accreditation and Certification interviews, risk assessments, and technical analyses

• to determine areas of risk and non-compliance with defined IS&T criteria aligned to cyber
• security frameworks (NIST CSF) and regulatory requirements (HIPAA Security, PCI DSS).

• Conducts Accreditation and Certification interviews, risk assessments, and technical analyses

• to determine areas of risk and non-compliance with defined IS&T criteria aligned to cyber
• security frameworks (NIST CSF) and regulatory requirements (HIPAA Security, PCI DSS)

• Uses broad and deep security knowledge and technical evaluation skills to help ensure risks

are appropriately identified, assessed, and documented

• Thoroughly reviews documentation, third party assessments, and audit samples for

• compliance with IS&T Accreditation criteria and identifies any discrepancies or corrective
• actions

• Executes IS&T Accreditation processes and activities including attestation review and

• technical security control analysis and testing, where applicable, to validate control
• effectiveness

• Escalates potential high or critical risk Accreditation findings to ensure alignment and

appropriate notification and remediation activities

• Weighs risk scope and impact when Identifying and articulating risk outcomes in final reports

and presentations to Accreditation stakeholders

• Reviews and assesses corrective action reports to determine effective remediation of

identified Accreditation and PCI DSS risks

• Identifies improvements and trends in review operations, criteria, and methodology, and

• develops plans and proposals to improve and evolve the IS&T Accreditation
• program/requirements over time

• Identifies areas of continuous improvement in the evaluation process and criteria, and

adjusts to the evolution of Accreditation operations and requirements

• Ensures timely communications and project management of individual Accreditation reviews

and PCI DSS compliance activities

• Maintains thorough and organized tracking of Accreditation and PCI DSS requirements,

assessment results, and corrective actions

• Support and educate affiliates and ancillary organizations on required PCI DSS compliance

activities

• Review and update internal PCI DSS training content, policies, and procedures, as

necessary, for national office staff.

• Execute annual PCI DSS self-assessment questionnaires for all payment flows to identify

security and technical deficiencies and collaborate across teams to remediate appropriately.

• Finalize and obtain signature for annual PCI DSS AOC.
• Facilite required vulnerability scanning of relevant cardholder data environments (CDEs),

• which includes running a quarterly scan, identifying security and technical deficiencies,
• ensuring appropriate scope, and following up for remediations or documenting exceptions.

• Obtain and manage external PCI DSS vendors’ AOCs
• Support the PPFA TPRM team, as needed
• Communicates professionally and effectively with technical, non-technical, and executive stakeholders
• All other duties as assigned

Knowledge, Skills and Abilities (KSAs)

• Bachelor’s degree and 5+ years of industry experience is required
• Experience with compliance requirements and industry standards (HIPAA Security, PCI DSS,

NIST, CIS, etc.) is required

• Current industry certifications, particularly security and/or auditing certifications, a plus

(CISA, CRISC, GSEC, etc.)

• Understanding of Information Security, Risk and Compliance
• Minimum of 2 years of experience in governance, risk, and compliance (GRC), assessing,

• auditing, accreditation, and evaluating or implementing IT and information security controls,
• including experience reviewing information security systems, policies, processes, technology
• environments, internal control frameworks, compliance requirements, and audit programs.

• A deep understanding of IT and information security environments and administration
• Strong written and verbal communication, including technical and non-technical writing skills
• Strong attention to detail and analytical skills
• Ability to balance firm adherence to security practices and flexibility in a fast-paced and

continuously changing environment

• Ability to maintain neutrality and fairness in the review process, and avoid or raise any

possible bias

• Knowledge of security technologies (security tools, networking, device protections,

encryption, data protection, identity and access management, etc.)

• Commitment and track record of advancing racial equity in both operations and

communications.

• High proficiency in Google products
• Flexibility and ability to adapt to quickly changing priorities and ambiguous situations