Information security officer

Role purpose: Lead and strengthen the organization’s information security and risk management program by identifying, assessing, and reducing cyber and operational risks while supporting compliance and resilience., * Own and maintain the information security risk management framework, policies, and standards.

• Conduct risk assessments (assets, threats, vulnerabilities, likelihood/impact) and maintain a risk register.
• Define and track risk treatment plans, controls, and remediation actions with clear owners and deadlines.
• Support security governance, including reporting, KPIs/KRIs, and executive/board updates.
• Coordinate audits and compliance activities (e.g., ISO 27001, NIST, SOC 2, GDPR or relevant local regulations).
• Review third-party/vendor risk and security requirements; support contract and due diligence processes.
• Partner with IT, engineering, and business teams to embed security-by-design in projects and change management.
• Contribute to incident readiness by supporting tabletop exercises, post-incident reviews, and continuous improvement.

• Risk management: proven experience with security risk assessments, control selection, and risk acceptance processes.
• Frameworks: working knowledge of ISO 27001/27002, NIST CSF/800-53, CIS Controls, and related best practices.
• Communication: ability to translate technical risks into business impact and actionable recommendations.
• Stakeholder management: coordinate cross-functional remediation and influence without direct authority.
• Documentation: strong policy, procedure, and audit evidence writing skills.