Job Details are given below
Application Security - Ensure that the Application Security Baseline Standard is followed by IT department in the development lifecycle of IT Systems
- For all IT projects, implement the cyber security requirements as defined in the ITRMG Referential Framework
- Work with development teams to ensure they embed security at design stage of applications, and related architecture (API, services, etc.)
- Perform security reviews of applications and ensure security requirements are met
- Provide guidance in securing applications data (particular focus for personal and sensitive data) during software development projects
- Maintain an up to date application Security dashboard
CYBER DEFENCE - Oversee the Cyber security Incident Management for both (business / production) incidents
- Build a strong network with other IT teams to follow-up on vulnerabilities remediation, and provide clear reporting to management
- Review threat intelligence reports from external sources (subscriptions, Central banks, etc.) and coordinate with relevant teams; ensure proactive / detective controls are in place
- Ensure that security, operational risks and remediation plans are properly managed
- Contribute in producing communications/training material and cyber culture awareness programs
- Assist and provide advisory services for operational staff (Remote access, Privileged account, Exception Management)
Data Security - Follow the Data Security/protection controls defined with ITRMG reverential framework for all new / existing applications.
- Investigate and review Data Leakage (DLP) alerts and follow the incident management process.
Contributing Responsibilities - Contribute in classifying applications based on confidentiality, integrity, availability and traceability, in order to identify the most critical IT Assets.
- Contribute to security permanent controls based on the group generic ICT control plans
- Prepare and present reports to senior management on Risks and Controls
Technical & Behavioral Competencies Functional Skills - Experience in IT Risk and Cyber Security domains in Financial Institutions
- Strong demonstrated knowledge of cyber security, cyber risks and cyber threats
- Able to perform Risk Assessments, Risk Analysis in Business Processes and providing Risk Opinion as a subject matter expert
- Demonstrate a calm professional approach in difficult scenarios, be focused on deliverables within time constraints and an understanding of when to escalate to management
Technical: - Good understanding of organizations and IT Businesses
- Good technical understanding of Infrastructure and IT Security Products and Systems
- Understanding of IT risk analysis/methods and risk management
- Knowledge of application code analysis (SAST/SCA), infrastructure and scanning tools (Qualys , Nexpose, Appspider, Fortify)
- GRC - Governance, Risk Management and Compliance Management.
- A good understanding of large-scale technology infrastructure and SOC/CERT operations.
- Working knowledge of Risk Management Tools
- IT Security tools like Firewalls, IPS, WAF, Endpoint protection, Network security, etc.
- Network protocols and network connectivity concepts; Firewall and Internet technologies; Cloud Security, Banking Tools & Technologies;
- Data Encryption; Encryption methods and Key management techniques
Behavioral: - Strong Communication, analytical and problem-solving skills
- Able to multi-task, prioritize and results orientated
- Good documentation and reporting skills
- Ability to work independently
- Strong communication and interpersonal skills, able to communicate with multiple stakeholders from business areas to technical experts
- Good at specifications interpretations, technical writing and schematic presentations
- Attention to detail and accuracy
- Able to think creatively and innovatively
- Self-discipline
Expected Contributions Contribute in both IT Risk Management/Cyber security Activities as directed by the management
Support teams in IT Risk/Cyber security projects as assigned.