Cyber Security Risk Management Officer (Remote)

Job Title:Cyber Security Risk Management Officer

Department: Risk Management

Section: Risk & Compliance

Function: Risk Management

Office Timings/ Location: 11:30 am to 7:30 pm/ Remote

Role Objective:

Understanding of relevant policies, procedures and processes relating to risk management and an appreciation of the policies and long-term goals of the department and that of the wider organization in which it operates.

Key Responsibilities & Accountabilities:

Strategic

• 1) Conducting cyber security risk assessment and create Risk Response Scenario plans and tests.
• 2) Researching on latest cyberthreats over the region.
• 3) Incident handling and reporting.
• 4) Handling regulatory and compliance requirements.
• 5) Reviewing information technology projects and conducting the gap assessments.
• 6) Providing subject matter expert advice on Cyber and Information Security.
• 7) Preparing MIS reports.

8) Familiarity with industry security standards including NIST, ISO, COBIT and Create overall cyber security risk management framework based on NIST to formulate cyber security strategy and cybersecurity policies based on the regulatory and quality requirements provided by CBB.

9) Conducting reviews on VAPT and reviewing and prioritizing vulnerability scans as per the schedule..

10) Ensuring that all controls are defined to ensure all regulatory requirements are met, designed effectively with clear documentation, and implemented with clear visibility into the evidence that control is working effectively.

11) Conducting system security log reviews.

12) Enforcing security standards, policies and create documents as required.

Operational

• 13) Direct point of contact for security audits and Complete PCI DSS Audits , Reports , mitigations and compliance requirements for yearly certifications in KW and BAH
• 14) Setting minimum security baseline.
• 15) Monitor the networks for security breaches and investigate a violation when one occurs
• 16) Secure implementations of Prevention tools and systems to mitigate Vulnerabilities such as Ransomware attacks, DOS/DDOS , Phishing Emails
• 17) Conduct penetration testing on Applications , Web Services , API's Internally and Externally through the vendors as part of Cybersecurity requirements of CBK, CBB, and CBE with
• 18) External ASV scanning
• 19) Internal vulnerability scanning
• 20) External network penetration
• 21) Internal Network penetration testing
• 22) Application security scanning APT
• 23) Segmentation penetration testing

People

24) Develop and write security information, security policies and procedures documents for compliance and audits with banks.

25) Hardening process and enforcement to Critical systems of business such as Database, Application servers , Web Servers.

26) Provide security awareness and knowledge to all levels to the Client which are related to the risks of common and social engineering attacks like phishing emails, unknown URL Unknown Sender ID, Financial payment requests.

27) Perform PT (Grey Box, Black Box) and VA tests External and internal for assessment as part of an overall checklist for cybersecurity risk assessments required for CBB and PCI.

28) Engage in the tools for DLP that eliminate the risk of information leaks or any third- party risks, or any unauthorized access for data leak points and leak credentials

Education & Qualifications:

1. A Bachelors or masters degree in Computer Science or Information Technology or related field.
2. Certified Information Security Manager (CISM) is a mandatory requirement.
3. Demonstrated experience in Cyber Security activities including reports.
4. Demonstrated ability to work independently and collaboratively.
5. The appointment will be subject to CBB approval, in case of relocating to Bahrain.
6. Experience in Cyber Security Risk assessments and developing Cyber Security risk frameworks and process.

Experience:

1. Minimum 7 to 8 years of experience in Cyber Security activities in financial institutions (Banks, Fintech, Audit).
2. Understanding of relevant policies, procedures and processes relating to Cyber Security and an appreciation of the policies and long-term goals of the department & that of the wider organization in which it operates.
3. Highly motivated and flexible to be able to work in a time-sensitive environment and respond quickly and effectively to unanticipated high workloads, events, and emergencies.
4. Ability to analyze and troubleshoot critical matters, good adaptability, and ability to work in flexible hours to meet the company demands and deadlines.

Soft Skills:

• 1.Excellentcommunicationskills, with fluency in English.
• 2.Knowledge of IT and Infrastructure
• 3.Excellentknowledge ofinformation security, related business processes, and
• 4.Strong knowledge and awareness of Corporate . Governance, Risk Management methodologies
• 5.Excellent knowledge of performing and managing principles. enterprise-wide risk assessments.
• 6.Ability to relate business requirements and risk to technology implementation for security-related issues. control objectives.