Job Description

Key Responsibilities

• Perform security risk assessments, formulate and advise on a risk treatment plan, assist the business in performing business impact analysis,
• Maintain cybersecurity risk registers, track remediation actions, and oversee security control testing.
• Review security testing reports (e.g. vulnerability assessment, penetration testing and secure code review) and work with application teams for remediation.
• Conduct regular vulnerability scans, penetration testing, and risk assessments to identify flaws across hardware, software, and cloud environments.
• Research emerging cyber threat vectors, vulnerabilities (CVEs), and attacker methodologies to update defensive protocols proactively.
• Work closely with Infrastructure and End User Support teams to identify and address any risks and gaps in the infrastructure, endpoints, and application systems
• Collaborate with third-party vendors and contractors to ensure the security of outsourced systems and services meets the industrial best practice to configure, deploy, and maintain critical security infrastructure, including firewalls, antivirus software, data loss prevention (DLP) tools, and regular vulnerability scans.
• Support vendor due-diligence process and help to guide overall third-party risk management efforts.
• Design and lead employee training programs to mitigate human-centric risks like phishing, social engineering, and poor password hygiene (e.g. newsletters, trainings, phishing campaigns)
• Lead the implementation of security protocols, establish robust system hardening standards across enterprise assets, conduct regular risk assessments on hardening control applied.
• Policy & Framework Development: Design, update, and maintain enterprise cybersecurity policies, standards, and control frameworks aligned with business goals
• Support and administer cybersecurity operations using enterprise security solutions (e.g. onboarding of privileged accounts to PAM, implementing WAF for website protection, and reviewing firewall rules, Tenable, Web defacement tools, report phishing tool management, etc.)
• Support both internal audit and external audits (e.g. ISO 27001, NIST, OWASP)
• Primary Point of Contact, and First Responder (monitoring and responding to alerts from Managed Services)
• Perform log analysis, investigate and respond to security incidents, including suspicious activities, phishing attempts, malware infections and data breaches.
• Collaborate with various teams to investigate, contain and remediate security incidents.

Education

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field
• Relevant professional certifications such as CISSP, CISM, or CISA are preferred.

Experience

• Minimum of 3 years of experience in cybersecurity
• Experience in cybersecurity governance, technology risk, or compliance assurance
• Experience with security technologies such as firewalls, intrusion detection/prevention systems, and data encryption
• Has knowledge in security technologies such as Antivirus/Endpoint Detection and Response (EDR), Privilege Access Management (PAM), Vulnerability Scanning tools, Phishing reporting tools, Web Defacement monitoring tools and Web Application Firewall (WAF)
• Familiarity with security assessment tools and techniques, including vulnerability scanning and penetration testing.
• Experience in vendor and project management

Skills and Attributes

• Excellent communication skills and the ability to explain complex technical concepts to non-technical stakeholders.
• Deep understanding of network infrastructure, TCP/IP protocols, routers, switches, and secure architecture principles.
• Strong analytical and problem-solving skills
• Highly driven and willing to learn