IT Security Officer

Job Summary

We are looking for an experienced IT Security Officer (ITSO) to support cybersecurity and application security activities across IT systems, applications, infrastructure, and cloud environments. The role will focus on security risk assessments, architecture reviews, vulnerability management, incident response, and ensuring security requirements are incorporated throughout the application development lifecycle.

Key Responsibilities

• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure, and cloud services.
• Review system architecture, data flows, interfaces, APIs, internet-facing entry points, and security controls to identify potential security risks and vulnerabilities.
• Assess mobile and web applications against application security principles, standards, and industry best practices.
• Perform threat modelling and develop threat profiles for application projects to identify, assess, and recommend remediation for security risks.
• Review remediation plans and supporting evidence to ensure identified security risks and vulnerabilities have been adequately addressed.
• Track security vulnerabilities and ensure timely remediation, patching, and closure in accordance with established security requirements.
• Support and review the integration of automated security testing within CI/CD and DevSecOps pipelines.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, compromised accounts, data breaches, unauthorized access, and cloud security incidents.
• Manage cybersecurity incidents through triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness sessions to promote good cybersecurity practices across stakeholders and project teams.
• Work closely with technical teams, application owners, developers, infrastructure teams, and other stakeholders to address cybersecurity risks and requirements.

Requirements

• Degree in Cybersecurity, Computer Science, Information Technology, or a related discipline, or an equivalent qualification.
• Minimum 5 years of combined experience in areas such as software development, application security, and cloud computing, including environments such as AWS.
• Strong understanding of mobile and web application architectures, APIs, and related technologies and protocols, including REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiarity with Agile development, CI/CD, and DevSecOps practices.
• Experience with tools and technologies such as GitLab, GitHub, and Ansible, including the integration of automated security testing into CI/CD pipelines.
• Hands-on experience with SAST/code scanning tools, such as Fortify on Demand, SonarQube, or equivalent.
• Experience in application security assessments, vulnerability management, cybersecurity risk assessment, and incident management.
• Strong analytical, troubleshooting, and problem-solving skills with the ability to work independently.
• Good written and verbal communication skills, with the ability to collaborate effectively with both technical and non-technical stakeholders.