Head of Information Security at OUTsurance

In this role, you will work with the Chief Information Security to set the strategic direction for the Information security .The Information Security function is central to delivering on the department’s security priorities.

Job Description
As the Head of Information Security, you will be responsible for not limited to below

• Leadership of the Information security area and its respective teams across Protective Monitoring, Testing, Incident Management, and Threat & Vulnerability Management.
• The development and implementation of the operating model and its underpinning processes and practices.
• The operational effectiveness and application of cyber security controls framework.
• The development and maintenance of security standards, guidance and playbooks.
• The effective and reliable detection and identification of security incidents.
• The resolution of security incidents and the coordination of operational response.
• The security testing regime, including technical audit, vulnerability management and penetration testing.
• The measurement and reporting on the efficacy and effectiveness of cyber security controls.
• The identification and monitoring of environmental, threat, and technology trends to optimise the effective short- and medium-term deployment of cyber security controls, contributing to the strategic security roadmap.

Accountable for the Information IT Governance, Risk and Compliance (GRC) stream, who is responsible for the following:

• Maintain IT risk register
• Facilitate IT risk workshop
• Identify key IT risks and be able to explain the impact on business
• Maintain and report on IT KRI dashboards
• Facilitate the risk management process on IT projects
• Identify improvements and breakdowns in IT governance elements with significant risk impact and feed into IT risk management function
• Responsible for IT risk reporting to the Internal Risk Committee
• Custodian of IT governance and IT process governance frameworks
• IT governance reporting
• IT policy creation, review and update
• IT policy and procedure awareness and enforcement
• IT process analysis and improvement recommendations
• IT Disaster Recovery
• Internal and external audit liaison
• Administration of key IT processes
• Provides guidance and clarify IT legislation to Risk and Compliance

Competencies

The successful individual would need to demonstrate the below listed competencies at an advanced level:

• 'Can do' attitude, comfortable dealing with ambiguity, resilient, strong team player, committed to continuous improvement
• Very strong interpersonal skills and the ability to build relationships
• Problem-solving with strong decision-making mind-set
• Takes initiative and works under own direction
• Engages professionally
• Adapts and responds positively to change
• The ability to multitask and handle stress to meet project deadlines
• Enthusiasm, energy, determination and a passion for improving client experience through digital platforms
• Works meticulously always demonstrating a very high level of attention to detail
• The ability to multitask and handle stress
• Strong problem solving skills and willingness to roll up one’s sleeves to get the job
• Excellent written and verbal communication skills
• Ability to communicate effectively with executive management

Qualifications

• 9 years’ experience in  IT Security
• 5 years’ experience in leading technical and operational security functions and teams.
• Strong security and technical background
• Deep knowledge of National Institute of Standards and Technology
• Relevant formal qualifications
• You will have strong people skills and experience of building and managing teams of specialists to deliver outcomes
• Real world experience of best practice

Your technical background should cover a wide spectrum of security engineering and operational skill sets. This must include but is not limited to a technical background in at least two of the following:

• Access and Identity management
• Network design
• Security analytics
• Incident management
• Software development
• Cloud architecture
• Penetration testing
• Security architecture and design
• Security Operations