Job Description

Certification required: Certified Information Security Manager (CISM)
Develop and drive IT security strategies aligned with business objectives, regulatory requirements, and organisational security objectives.
Plan, propose, and coordinate the Annual IT Security Assessment programme, ensuring timely execution and effective remediation of identified findings.
Oversee day-to-day IT security operations, providing guidance on incident response, vulnerability management, compliance, and risk mitigation activities.
Review, develop, and maintain security policies, processes, procedures, guidelines, standards, baselines, and the System Security Plan to ensure alignment with the current infrastructure and risk posture.
Identify and assess risks relating to data protection, regulatory compliance, and privacy, recommending appropriate risk treatment, remediation, and risk acceptance strategies for client approval.
Configure and manage security tools, including Tenable SC, Nessus Manager, Nessus Professional, and Kali Linux.
Conduct and review Network Vulnerability Assessments (VAPT) across on-premises and cloud environments, as well as Web Application Penetration Testing.
Manage Data/Change Management, Backup, Batch Job Management, and Problem/Incident Management processes.
Plan and deliver IT Security Awareness training programmes to strengthen organisational security awareness and culture.
Respond to IT security incidents by investigating logs and artefacts, determining root causes, and supporting timely recovery efforts.
Prepare and deliver monthly security posture reports to project management and client stakeholders, covering risk exposure, remediation progress, and key security metrics.
Serve as the primary point of contact for internal and external IT security audits, coordinating Requests for Information (RFIs), facilitating audit fieldwork, gathering evidence, and ensuring timely closure of audit findings.
Plan, coordinate, and lead Service Management Audits, working with auditors to complete fieldwork and ensure documentation meets required standards.
Lead the IM8 audit process end-to-end, coordinating stakeholders, organising audit evidence, and ensuring all audit activities are completed within stipulated timelines.
Manage the annual review and revision of the Scope of Procedures document, obtaining approval from the Project Director and client and maintaining accurate, version-controlled documentation.
Engage and onboard external auditors cost-effectively, define audit scope, and align audit deliverables with organisational requirements and timelines.
Collaborate with auditors and internal teams to develop and maintain the System Security Plan, ensuring it accurately reflects the current security environment.
Review audit findings and vulnerability assessment results, recommend appropriate remediation measures, and monitor progress to ensure identified security gaps are addressed.