Information Security Officer

Description & Requirements

• Support the implementation and operations of the ISMS within the region.
• Support alignment with global security policies and regulatory requirements including ISO27001, SOC2 type II and PCI-DSS.
• Support continuous assessment and improvement of security controls and processes.
• Support, identify, assess, and mitigate security risks.
• Maintain the risk register and track remediation activities.
• Provide risk-based guidance to business units, IT teams, and client-facing operations.
• Support compliance with corporate security policies, frameworks, and client-specific security mandates.
• Support develop and enforce security standards and client requirements.
• Input into periodic reviews and updates to security policies to align with evolving requirements.
• Support internal and external security audits, ensuring timely remediation of findings.
• Provide security assurance to clients by responding to security questionnaires and participating in client audits.
• Coordinate with service delivery teams to meet client-specific obligations.
• Monitor and report on security posture, client security commitments, and compliance status.
• Support the delivery of security awareness programs
• Support phishing exercises and other training initiatives to enhance security culture.
• Collaborate with HR and other departments to ensure security education is embedded in employee onboarding and ongoing training.
• Support the assessment and management of security risks associated with third-party vendors and suppliers.
• Support security requirements are included in vendor contracts and SLAs.
• Enable regular security assessments of critical suppliers, considering the impact on client services.
• Assist in managing and responding to security incidents within the region, to ensure rapid containment and remediation.
• Work with the Security Operations team to protect both internal and client environments.
• Support post-incident reviews and contribute to continuous improvement in incident handling, including lessons learned for client operations.