Information Security Officer

Job Summary

Security Strategy and Governance

• Establish and maintain the enterprise information security management programme.
• Design, implement, and monitor the information security strategy and IT risk management programme.
• Develop security policies, procedures, and technical standards based on regulations and risk findings.
• Lead auditing and compliance initiatives.

Risk and Controls

• Identify and assess IT security risks and conduct information security risk assessments.
• Test data-processing systems and design, plan, and implement internal controls for technical security.
• Assess systems for security gaps, design solutions, report findings, and regulate access to restricted data and systems.

Technical Security Operations

• Design, maintain, and review IT security architecture and firewalls across information systems and networks.
• Plan regular penetration tests, evaluate results, and oversee closure of identified gaps.
• Execute vulnerability assessments and oversee patch-management systems.
• Conduct real-time threat analysis and triage incidents as they arise.

Incident Response and Continuity

• Investigate and report security incidents and test breach responses through tabletop exercises.
• Support IT disaster-recovery plans and strategies and address intrusions quickly and effectively.
• Test backup and recovery procedures.

Awareness and Engagement

• Train staff on the proper use of information systems and partner with business stakeholders to raise information-risk awareness.
• Coordinate, supervise, manage, and train others.
• Stay current with security legislation, regulations, alerts, and emerging threats.

Education and Experience

• Bachelor's degree, preferably in Information Technology or Computer Science.
• CISSP or CISM certification is desirable.
• More than 5 years of relevant information security experience.
• Strong analytical, reasoning, and reporting skills.

Technical Knowledge

• In-depth knowledge of ISO 27001, ITIL, COBIT, NIA, and the National Cyber Security Framework.
• Strong technical skills in Active Directory, proxy, antivirus, network security, encryption, vulnerability assessment and penetration testing, and web services security.