Chief Information Security Officer - Cyber Security

Chief Information Security Officer - Cyber Security

Responsibilities

BU CISO

Cybersecurity Strategy and Governance:

Develop, implement, and lead the cybersecurity strategy for the assigned business unit, ensuring alignment with organizational goals group cyber security strategy and industry best practices.

Establish and enforce cybersecurity policies, procedures, and governance frameworks specific to the business unit.

Ensure cybersecurity initiatives are in compliance with applicable regulatory frameworks and internal standards (e.g., GDPR, ISO 27001, NIST, etc.).

Ensure business level cyber security KPIs are achieved and maintained.

Risk Management and Threat Assessment:

Lead the identification, assessment, and management of cybersecurity risks within the business unit, prioritizing mitigation strategies based on business impact.

Conduct regular risk assessments and threat modeling exercises to identify vulnerabilities and threats relevant to the business unit.

Collaborate with other business units and teams to ensure a holistic approach to risk management across the organization.

Minimize the cybersecurity exceptions at business level.

Cybersecurity Operations:

Oversee the day-to-day cybersecurity operations within the business unit, ensuring that security controls are effectively implemented and maintained.

Ensure timely detection, response, and resolution of security incidents, working closely with the SOC (Security Operations Center) and incident response teams.

Manage the security incident management lifecycle, including investigation, root cause analysis, and remediation efforts.

Collaboration with Business Leaders:

Collaborate with senior leadership and business unit managers to understand business goals and ensure that cybersecurity investments and strategies support those objectives.

Act as the primary point of contact for cybersecurity matters within the business unit, providing expert advice and guidance to business unit stakeholders.

Ensure cybersecurity risks and priorities are effectively communicated and understood at the business unit leadership level.

Cybersecurity Awareness and Training:

Lead initiatives to enhance cybersecurity awareness and build a culture of security within the business unit, including organizing training and awareness programs.

Work with Group Awareness and BU HR teams to develop cybersecurity training programs tailored to the specific needs of the business unit.

Promote secure behavior across teams by fostering good security hygiene practices and continuous education.

Security Architecture and Design:

Collaborate with the architecture and engineering teams to ensure that cybersecurity is integrated into the design and architecture of business unit systems, applications, and infrastructure.

Review and approve security architecture for projects, ensuring that secure coding, encryption, and other security best practices are followed.

Incident Response and Crisis Management:

Lead the business unit’s response to cybersecurity incidents, ensuring timely coordination and escalation to executive leadership when necessary.

Develop and maintain incident response plans and disaster recovery protocols specific to the business unit, ensuring they align with the organization’s overall plans.

Conduct tabletop exercises and incident simulations to improve readiness and response capabilities.

Metrics and Reporting:

Develop and track key performance indicators (KPIs) to measure the effectiveness of the business unit's cybersecurity efforts.

Provide regular reports to senior leadership on the status of cybersecurity activities, risks, and incidents within the business unit.

Utilize data and metrics to continuously improve security processes and identify areas for improvement.

Third-Party Risk Management:

Oversee the security posture of third-party vendors and partners that interact with the business unit, ensuring that they comply with organizational security standards.

Conduct regular assessments of third-party risks, including vendor assessments, contract negotiations, and due diligence processes.

Budgeting and Resource Management:

Manage the cybersecurity budget for the business unit, ensuring that investments are aligned with priority risks and initiatives.

Identify resource needs and lead recruitment and retention efforts to build and maintain a high-performing cybersecurity team within the business unit.

Key Stakeholders - Internal

Executive Leadership

Department Heads

Legal and Compliance

IT Team

Risk Management Team

Security Awareness and Training Teams

Incident Response Team

Procurement and Vendor Management Teams

Internal Security and Penetration Testing Teams

Engineering and Development Teams

Key Stakeholders - External

Cloud Service Providers

Consultants and Industry Experts

Regulatory Bodies and Compliance Authorities

External Auditors

Managed Security Service Providers (MSSPs)

Industry Associations and Cybersecurity Forums

Qualifications

Educational Qualification:

Minimum Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.

Advanced degree (e.g., Master's, MBA) in Cybersecurity, Information Assurance, or a relevant discipline is highly desirable..

Certification:

Relevant certifications such as CISSP, CISM, CISA, CISA, or ISO 27001 Lead Implementer are highly desirable.

Work Experience (Range of years):

Minimum 10 years of experience in cybersecurity.