Information Security Officer

The Information Security Officer is responsible for developing, implementing, and maintaining the organization's information security framework to protect information assets, systems, networks, and digital infrastructure from cyber threats and security breaches. The role ensures compliance with cybersecurity standards, regulatory requirements, and industry best practices while promoting a strong security culture across the organization.Key ResponsibilitiesDevelop, implement, and maintain the organization's information security policies, standards, and procedures.Monitor the organization's IT infrastructure for security threats, vulnerabilities, and suspicious activities.Conduct regular risk assessments and vulnerability assessments to identify and mitigate security risks.Coordinate penetration testing, security audits, and compliance assessments.Implement and manage security controls to safeguard information systems, networks, databases, and cloud environments.Investigate security incidents, coordinate incident response activities, and recommend corrective actions.Develop and maintain business continuity, disaster recovery, and cyber incident response plans.Ensure compliance with applicable information security regulations, data protection laws, and industry standards such as ISO 27001, NIST, CIS Controls, and GDPR where applicable.Manage identity and access management processes, including user access reviews and privileged account monitoring.Monitor firewall, endpoint protection, intrusion detection/prevention systems, SIEM platforms, and other security technologies.Conduct security awareness and cybersecurity training programs for employees.Collaborate with IT teams to integrate security into system development, infrastructure, and cloud deployments.Review third-party vendors and technology solutions to ensure compliance with organizational security requirements.Prepare security reports, dashboards, and risk assessments for senior management.Maintain security documentation, asset inventories, and compliance records.Support internal and external audits related to information security.Stay informed about emerging cyber threats, vulnerabilities, and security technologies.Recommend and implement continuous improvements to the organization's cybersecurity posture.Perform any other duties assigned by management.QualificationsEducationMaster's Degree in Cyber Security, Information Security, Computer Science, Information Technology, Information Systems, Network Security, Computer Engineering, or a related field.Professional certifications such as CISSP, CISM, CISA, CEH, CompTIA Security+, ISO/IEC 27001 Lead Implementer or Lead Auditor, Microsoft Security Certifications, AWS Security Specialty, or Certified Cloud Security Professional (CCSP) will be an added advantage.ExperienceMinimum of 5 years of progressive experience in information security, cybersecurity, network security, IT risk management, or information technology.Demonstrated experience implementing enterprise information security programs and security governance frameworks.Proven experience with security monitoring, vulnerability management, incident response, and risk assessments.Experience administering security technologies such as firewalls, SIEM, endpoint protection, identity and access management, and cloud security solutions.Experience supporting compliance with information security standards and regulatory requirements.Required Skills & CompetenciesStrong knowledge of cybersecurity principles, frameworks, and best practices.Thorough understanding of ISO 27001, NIST Cybersecurity Framework, CIS Controls, COBIT, and related standards.Knowledge of cloud security, virtualization, and hybrid IT environments.Strong understanding of networking concepts, operating systems, databases, and web application security.Experience with security monitoring, SIEM platforms, threat intelligence, and log analysis.Excellent risk assessment and security governance skills.Strong analytical and problem-solving abilities.Excellent incident investigation and response capabilities.Strong report writing and technical documentation skills.Excellent communication and stakeholder management skills.Ability to manage multiple projects and priorities effectively.High level of integrity, confidentiality, and ethical conduct.Strong project management and organizational skills.Proficiency in Microsoft Office Suite and security management tools.Key Performance Indicators (KPIs)Number and severity of security incidents.Incident detection, response, and resolution times.Compliance with information security policies and regulatory requirements.Vulnerability remediation rate.Security audit outcomes.Percentage of systems compliant with security standards.User security awareness training completion and effectiveness.Risk assessment completion and mitigation effectiveness.Business continuity and disaster recovery readiness.Reduction in cybersecurity risks and successful implementation of security improvements.Third-party security compliance.Timeliness and quality of security reporting.