Job Description

The Information Security Governance Officer is responsible for establishing and maintaining a robust information security governance framework within an organization. This role involves developing policies, procedures, and controls to ensure the confidentiality, integrity, and availability of information assets. The Information Security Governance Officer plays a crucial role in managing risks, ensuring compliance with regulatory requirements, and promoting a culture of information security throughout the organization.

Responsibilities:

• Information Security Policies and Procedures: Develop, implement, and maintain information security policies, standards, and procedures that align with industry best practices and regulatory requirements.
• Governance Framework: Establish and maintain an effective information security governance framework, including risk assessment methodologies, control frameworks, and compliance monitoring processes.
• Risk Assessment and Management: Conduct regular risk assessments to identify and evaluate information security risks, and develop risk treatment plans to mitigate and manage those risks.
• Compliance and Regulatory Requirements: Monitor and ensure compliance with applicable laws, regulations, and industry standards related to information security, privacy, and data protection.
• Security Awareness and Training: Develop and deliver security awareness and training programs to promote a culture of information security among employees, contractors, and third parties.
• Incident Response and Management: Collaborate with incident response teams to develop and maintain an effective incident response plan, including roles, responsibilities, and procedures for addressing and resolving security incidents.
• Security Controls and Audit: Establish and maintain controls to protect information assets, conduct security audits and assessments to verify compliance, and address any identified vulnerabilities or deficiencies.
• Vendor Risk Management: Assess and manage information security risks associated with third-party vendors and service providers, including conducting due diligence, evaluating security controls, and monitoring ongoing compliance.
• Security Metrics and Reporting: Develop and maintain security metrics and reporting mechanisms to track and communicate the effectiveness of information security controls, risk mitigation efforts, and compliance status.
• Continuous Improvement: Stay abreast of emerging threats, vulnerabilities, and industry trends, and recommend enhancements to the information security governance framework to ensure ongoing effectiveness.

Qualifications:

• Bachelor’s degree in information security, computer science, or a related field. Relevant certifications such as Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) are preferred.
• Strong knowledge of information security principles, frameworks, and best practices, such as ISO 27001/27002, NIST Cybersecurity Framework, or COBIT.
• Familiarity with applicable laws, regulations, and industry standards related to information security, privacy, and data protection (e.g., GDPR, HIPAA, PCI DSS).
• Experience in developing and implementing information security policies, procedures, and controls.
• Strong understanding of risk management principles and methodologies.
• Excellent written and verbal communication skills to effectively communicate security concepts and requirements to technical and non-technical stakeholders.
• Analytical and problem-solving abilities to assess risks, analyze security incidents, and develop appropriate responses.
• Knowledge of security technologies, tools, and controls, such as firewalls, intrusion detection systems, access controls, and vulnerability management systems.
• Familiarity with security governance and risk management frameworks, such as COBIT or ITIL.
• Strong project management skills to effectively manage security-related initiatives and prioritize tasks.
• Ability to work independently, manage multiple projects, and meet deadlines.
• Strong ethical standards and the ability to handle sensitive and confidential information.