JOB PURPOSE:

The Senior Information Security Officer is responsible for establishing and maintaining a corporate-wide information security management program to ensure that information assets are adequately protected. This position is responsible for identifying, evaluating, and reporting on information security risks in a manner that meets compliance and regulatory requirements, and aligns with and supports the risk posture of the enterprise.

KEY ACCOUNTABILITIES:

Information Security Governance, Risk and Compliance (GRC)

• Facilitate information security governance through the implementation of a hierarchical governance program, including the support of all necessary reporting requirements and metrics for the Bank Operational Risk – Information Security Steering Committee or any corresponding advisory board requirements.
• Develop, maintain and publish up-to-date information security policies, standards, and guidelines. Oversee the approval, training, and dissemination of security policies and practices.
• Create, communicate and implement a risk-based process for vendor risk management, including the assessment and treatment for risks that may result from partners, consultants, and other service providers.
• Create and manage information security and risk management awareness training programs for all employees, contractors, and approved system users.
• Work directly with the business units to facilitate IT risk assessment and risk management processes and work with stakeholders throughout the enterprise on identifying acceptable levels of residual risk.
• Provide regular reporting on the current status of the information security program to enterprise risk teams, senior business leaders, and the board of directors as part of a strategic enterprise risk management program.
• Define and facilitate the information security risk assessment process, including the reporting and oversight of treatment efforts to address negative findings.
• Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the security.
• Understand and interact with related disciplines through committees to ensure the consistent application of policies and standards across all technology projects, systems and services, including, but not limited to, privacy, risk management, compliance, and business continuity management.
• Understand the requirements of data security governance and ensure to develop and implement the process requirements for both data classification and data privacy in the bank covering all bank stakeholders

Department and project advisory

• Provide strategic risk guidance for IT projects, including the evaluation and recommendation of technical controls.
• Coordinate information security and risk management projects with resources from the IT organization and business unit teams.

Operational Support

• Coordinate measures and report on the technical aspects of security management.
• Manage outsourced vendors that provide information security functions for compliance with contracted service-level agreements.
• Manage and coordinate operational components of incident management, including detection, response, and reporting.
• Maintain a knowledge base comprising a technical reference library, security advisories and alerts, information on security trends and practices, and laws and regulations.
• Manage the day-to-day activities of threat and vulnerability management, identify risk tolerances, recommend treatment plans and communicate information about residual risk.
• Ensure audit trails, system logs, and other monitoring data sources are reviewed periodically and comply with policies and audit requirements.
• Design, coordinate and oversee security-testing procedures to verify the security of systems, networks, and applications, and manage the remediation of identified risks.
• Provide advisory and keep up to date on Information security threats, technologies and techniques, and ensure the threat landscape is understood and raised with the concerned departments for remediation.
• Provide Advisory and consultation to IT and IT Security to ensure that security is factored into the evaluation, selection, installation and configuration of hardware, applications and software
• Research, evaluate, design, test, recommend or plan the implementation of new or updated information security hardware or software, and analyse its impact on the existing environment; provide technical and managerial expertise for the administration of security tools.

Relationship building and influencing

• Build relationships with key stakeholders and peers to ensure information security has an appropriate focus.
• Influence key stakeholders and peers to ensure security is effective.

Legal, Compliance and Regulatory obligations

• Update the Information Security Steering members with any new regulations and compliance requirements related to the Information Security of the Bank.
• Conduct gap analysis and ensuring the Bank is in compliance with Information Security regulations and Law.
• Liaise among the information security team and corporate compliance, audit, legal, and HR management teams as required.
• Liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure that the organization maintains a strong security posture.
• Manage security issues and participate in problem and change management forums. Ensuring timely reporting and adequate participation in the investigation for IS &IT security incidents, with QCB, Q-CERT, NCSA, and/or Law Enforcement agencies as applicable.
• Abide by Bank’s Information Security Policies and Procedures and ensure the confidentiality, integrity and availability of bank’s data and information under employee’s custody.

Policies and Procedures

• Develop, maintain and ensure implementation of Information Security Policies and Procedures for the Bank.
• Perform all work in accordance with departmental and bank-wide policies, processes, procedures and instructions so that work is carried out in a controlled and consistent manner while delivering a high quality and cost effective service to customers.
• Suggest improvements to policies, procedures, principles and standards for operational improvements or due to changes in best practices and/or regulation.
• Monitoring, reviewing and ensuring the implementation of the Information Security Policies and Procedures across the Bank.

QUALIFICATIONS, EXPERIENCE, & SKILLS:

Qualifications:

• Bachelor’s degree in IT, Computer science or Information/Cyber Security. A higher related degree is an advantage.
• Must have at least one of the following Professional qualifications (ISC2 CISSP, SANS GIAC or ISACA CISA/CISM or higher)

Experience:

• 5- 7 years of relevant experience in Information Security
• Experience in the banking sector is preferred

Job-Specific Skills (Generic / Technical):

• Knowledge of the banking sector in Qatar and the region. (preferred)
• Experience with common information security management frameworks, such as International Standards Organization (ISO) 2700x, PCI DSS, The IT Infrastructure Library (ITIL), and Control Objectives for Information and Related Technology (COBIT) frameworks.
• Proficiency in performing risk, business impact, control, and vulnerability assessments, and in defining treatment strategies.
• Good working knowledge of regulatory and industry security specifications e.g. payment card industry (PCI, MasterCard, Visa) and regulatory bodies (financial service and central bank authorities).
• Preferably knowledge of local laws and regulations (State of Qatar, Qatar Central Bank, SWIFT, NAPS).
• Preferably banking experience or knowledge of banking operations especially around payments and alternative /electronic channels.
• Exhibit excellent analytical skills, the ability to manage multiple projects under strict timelines, as well as the ability to work well in a demanding, dynamic environment and meet overall objectives.
• Project management skills: financial/budget management, scheduling, and resource management.
• Ability to lead/ support and motivate cross-functional, interdisciplinary teams to achieve tactical and strategic goals.
• Experience in system technology security testing (vulnerability scanning and penetration testing) and local vulnerability scanning tools usage such as Nessus, Nexpose and/or Qualys.
• Familiarity in application technology security testing (white box, black box, and code review)
• Strong analytical skills to analyse security requirements and relate them to appropriate security controls.
• Solid knowledge and experience of information technology hardware and software.
• Good knowledge around IT Security solutions such as (Firewall, WAF, NAC, IPS and SIEM)
• Good knowledge in conducting information security risk assessment (GRC tools use is recommended)
• Good working knowledge on running phishing campaign using tools such as PhishMe (Cofense) or similar tools.
• Knowledge of and experience in developing and documenting security architecture and plans, including strategic, tactical, and project plans.
• Creative, logical thinking and able to influence all parties (senior and junior).
• Good communication and presentational skills.
• Ability to work under pressure.
• Planning and organising skills.
• English & Arabic lanugage required.