Information Security Lead  

An Information Security Lead will be responsible for

• Establishing and maintaining a corporate wide information security management program to ensure that information assets are adequately protected
• Identifying, evaluating, and reporting on information security risks in a manner that meets compliance and regulatory requirements, and aligns with and supports the risk posture of the enterprise
• Facilitating information security governance through the implementation of a hierarchical governance program, including the formation of an information security steering committee or advisory board.
• Developing, maintaining and publishing up-to-date information security policies, standards and guidelines. Oversee the approval, training, and dissemination of security policies and practices.
• Creating a framework for roles and responsibilities regarding information ownership, classification, accountability and protection.
• Providing strategic risk guidance for IT projects, including the evaluation and recommendation of technical controls.
• Liaising with the enterprise architecture team to ensure alignment between the security and enterprise architectures, thus coordinating the strategic planning implicit in these architectures.
• Coordinating information security and risk management projects with resources from the IT organization and business unit teams.
• Developing and overseeing effective disaster recovery policies and standards to align with enterprise business continuity management program goals. Coordinate the development of implementation plans and procedures to ensure that business-critical services are recovered in the event of a security event. Provide direction, support, and in-house consulting in these areas.

• Graduate of Bachelor's degree in Computer Science, Computer Engineering, or other related courses
• At least 7 years of IT experience, 5 years of which from information security role and 2 years in supervisory capacity
• Been exposed to system technology security testing (vulnerability scanning and penetration testing).
• Familiarity in application technology security testing (white box, black box and code review)
• Proficiency in performing risk, business impact, control and vulnerability assessments, and in defining treatment strategies.
• Knowledge of and experience in developing and documenting security architecture and plans, including strategic, tactical and project plans.
• Strong analytical skills to analyze security requirements and relate them to appropriate security controls.
• An understanding of operating system internals and network protocols.
• Familiarity with the principles of cryptography and cryptanalysis.
• A strong understanding of the business impact of security tools, technologies and policies.
• Strong leadership abilities, with the capability to develop and guide information security team members and IT operations personnel, and work with minimal supervision.