Overview
The Information Systems Security Officer is responsible for ensuring the effective implementation of the Organization's information security strategy within the Information Systems and Technology Directorate, focusing on governance, risk, and compliance aspects of IT security.
Key Responsibilities
- Collaborate with the CISO to ensure the implementation of organizational information security strategy within the IS Directorate.
- Act as an entry point within IS for OIO audits and Assessments of IS IT Security compliance.
- Develop and maintain IS security Standards and guidelines in alignment with organizational security policies.
- Ensure compliance with relevant laws, regulations, and industry standards related to IT security.
- Participate in the development of the IS security roadmap and ensure its alignment with the organizational security strategy.
- Report on progress towards compliance with security policies, procedures, and standards to management and stakeholders.
- Maintain the IS Directorate's security risk register and perform IT security risk assessments and analysis.
- Liaise with the CISO to escalate strategic IT security risks linked to technology or within the scope of work of the IS Directorate.
- Assist in security audits, assessments, and penetration tests, by reviewing and analyzing findings, and advise the IS Directorate on corrective actions or enhancements to IT products or projects.
- Develop and maintain a risk management framework for the IS Directorate.
- Provide advice and guidance on specific IT security aspects of projects and products.
- Participate in initiatives to inform and train colleagues about security awareness and best practices.
- Act as the IS Directorate point of contact for security or IT-related investigations and other security matters.
- Collaborate with teams to ensure they meet deadlines and comply with security requirements, providing guidance and support as needed.
- Collect and report on relevant KPIs to measure the effectiveness of IS security governance, risk, and compliance activities.
- Prepare and present regular reports to management and stakeholders on IS security performance, risks, and compliance.
- Identify areas for improvement and propose corrective actions to enhance IS security governance, risk, and compliance.
- Perform any other duties as required by the supervisor.
Required Experience
At least 5 years of experience in a large and complex IT enterprise environment. Experience in developing and maintaining information security policies, standards, procedures, and guidelines, and ensuring their alignment with organizational security standards and industry best practices. Proven track record of identifying and mitigating IT security risks and developing and implementing risk management plans to minimize potential impacts on the organization. Experience in conducting security audits, assessments, and compliance reviews, and providing recommendations for remediation and improvement to ensure adherence to organizational security policies and industry standards.
Qualifications
Three to four years’ education at a University or specialized higher education establishment. One or more internationally recognized IT Security Certifications (CISM, CISSP, CEH, etc.). Other certifications including ITIL foundation are appreciated.
