Job purpose:
The Information Security Officer (ISO) develops, implements, and oversees the organization’s information security strategy and protection measures. The role ensures the security of information assets, compliance with regulatory obligations, and continual enhancement of cybersecurity resilience. The ISO leads initiatives related to risk management, incident response, continuity planning, vulnerability reduction, and employee awareness.
Responsibilities:
1. Security Program Development
- Develop, implement, and maintain a comprehensive information security program aligned with industry frameworks (e.g., ISO 27001, NIST)
- Define and maintain security policies, standards, and procedures
- Conduct periodic maturity assessments and drive continuous improvement
- Tracking and evaluating security measures implemented for the services and products developed by the company, throughout their lifecycle.
2. Incident Response Management
- Own and maintain the Incident Response Plan (IRP)
- Lead incident handling activities: detection, containment, eradication, recovery, and post incident review
- Coordinate forensic investigations and documentation.
3. Business Continuity & Crisis Management
- Develop and maintain the Business Continuity Plan (BCP) and Crisis Management framework
- Coordinate business impact analyses and continuity exercises
- Provide leadership support during crisis situations to ensure operational resilience.
4. Risk Assessment & Management
- Conduct regular security risk assessments across systems, projects, and third parties
- Identify threats, vulnerabilities, and potential business impacts
- Recommend and track mitigation strategies and maintain a security risk register.
5. Vulnerability Management
- Develop and oversee the organization’s Vulnerability Management Program
- Coordinate periodic vulnerability scans, penetration testing, and configuration assessments
- Work with IT and engineering teams to prioritize remediation based on risk
- Track closure of vulnerabilities and ensure compliance with internal SLAs
- Monitor threat intelligence feeds to assess exposure to emerging vulnerabilities.
6. Regulatory Compliance
- Ensure compliance with applicable security and data protection regulations (e.g., NIS2, GDPR, EIDAS, industry standards)
- Coordinate internal and external audits, assessments, and certification processes
- Maintain compliance documentation and support regulatory reporting.
7. Security Awareness & Training
- Develop and deliver security awareness and training programs
- Conduct phishing simulations, workshops, and targeted training for high risk roles
- Promote a culture of security across the organization.
Skills & Relevant Work Experience
- Bachelor’s or Master’s degree in Information Security, Computer Science, or related field.
- 5+ years of experience in cybersecurity or information risk management.
- 8-10 years working experience in information technology.
- Demonstrated experience in incident response, risk analysis, and security program leadership.
- Certifications (Preferred): CISSP, CISM, CEH, CRISC, ISO 27001 Lead Implementer/Auditor, or similar.
- Strong understanding of threat landscapes, security technologies, and regulatory obligations.
- Good multi-platform knowledge. Experience in Windows, Linux, Mac, Android, AWS/Azure, Networking, Firewalls, Office 365, etc.
- Security functional knowledge including: EDR, SIEM/SOAR, AV, intrusion detection, incident response, policy writing, vulnerability testing, operating system hardening, regulatory compliance, and data classification.
- Experience in defining and implementing security solutions, policies, and technologies relating to Identity Management, Information Protection etc., with experience in Business Continuity/ Disaster Recovery implementations and executions.
- This role must have technical expertise in security architecture, enterprise architecture, and security concepts related to networking, endpoint security, cloud technology, cyber-attack techniques, and incident handling procedures. This requires deep domain knowledge in many technical areas, but also extends to business processes such as regulations, legal, and human resources.
- Experience defining and managing an information security program in accordance with the international standards (e.g. NIST, ISO/IEC 27001, NIS, eIDAS, Webtrust).
- Expertise in vulnerability management processes and tools.
- High integrity and confidentiality.
- Strategic and proactive thinker.
- Strong leadership and coordination skills.
- Ability to remain calm and effective under pressure.
- Strong work ethic with attention to detail.
- Excellent oral and written communication skills with ability to influence stakeholders at all levels.
- Strong analytical, problem solving, and crisis management abilities.
For this position, the company reserves the right to request professional references and/or letters of recommendation.
