Description du poste

• Establish risk guidelines for the information security strategy of the client
• Contribute to defining the Information Security Strategy, including cyber risks mitigation.
• Establish guidelines for the design of the information security controls
• Align the client's risk appetite for security incidents and vulnerability management
• Monitor and review the management of security events, incidents, and vulnerabilities upon their conclusion
• Establish an Identity and Access Management (IAM) policy, review the implementation of the controls and conduct periodic reviews of user access
• Participate in the planning of IT security assessments and penetration testing by the IT Security function and review the status of the follow-up actions
• Review the management of IT security incidents
• Review the management of web activities reports
• Review the performance monitoring reports (availability, backup, capacity, network)
• Design and perform regular IT access review and implementation of IT controls
• Provide input to the training and phishing exercises organised by IT&FM
• Perform periodic reviews of the information security risk assessments conducted for prospective service providers and the risk assessments conducted pursuant to the Outsourcing Policy
• Establish information security rules which are reflected in Information Security Policy

Profil recherché

• University degree in the field of IT risk management, Computer Sciences or related disciplines
• Minimum 8 years of relevant experience in Information security or related activities
• Proven track record of success in information security implementation, information security audit, preferably in a financial services domain
• Experience in Information Security Policy implementation and maintenance
• Knowledge of relevant ISO standards (e.g. ISO/IEC 2700x)
• CISA/CISSP or equivalent certification
• Technically expert in information security with a strong understanding of industry best practices and regulations
• Knowledge of principles and techniques of information security risk analysis and assessment
• Experience in incident management and/or crisis management response procedures
• Experience in investigation and response management
• Experience in developing and implementing monitoring, performance, and reporting metrics
• Exposure to operational risk management and activities will be considered a plus
• Strong written and verbal communication skills
• Fluency in English