Job Purpose:
We are looking for a dynamic and experienced Senior Manager of Information Security to lead our security initiatives, focusing on secure software development lifecycle (SDLC) and strategic leadership. The ideal candidate will have a strong background in managing complex security programs, leading teams, and ensuring robust security practices across the organization. This role demands a visionary leader who can drive security excellence while effectively managing resources and collaborating with senior stakeholders.
Key Responsibilities for the Role
- Strategically lead and manage the organization's vulnerability management and application security programs, ensuring comprehensive identification, analysis, and remediation of security risks.
- Oversee the integration of security practices within the SDLC, collaborating with development and operations teams to ensure secure and compliant application development and deployment.
- Expert in DevSecOps, integrating security practices throughout the SDLC with automation and compliance tools to enhance code integrity and data protection.
- Plan, coordinate, and manage annual penetration testing activities across all applications being used in MBPL, ensuring thorough coverage and effective risk mitigation.
- Lead and mentor a team of security professionals, fostering a culture of excellence, continuous learning, and proactive security awareness.
- Conduct and oversee IT compliance assessments and reviews, ensuring adherence to industry standards such as NIST 800-53 and the NIST Cybersecurity Framework.
- Certify and approve technical platforms post-security reviews, ensuring all systems are secure and resilient against emerging threats.
- Monitor and analyze the organization's threat landscape, developing strategic mitigation plans and ensuring effective monitoring and reporting mechanisms are in place.
- Evaluate and implement advanced security solutions and tools, ensuring the organization's security infrastructure remains robust and up-to-date.
- Collaborate with executive leadership to develop and implement comprehensive information security strategies aligned with organizational goals and objectives.
- Communicate and coordinate with various stakeholders to ensure transparency and alignment in security initiatives and compliance efforts.
- Prepare and present detailed security reports and recommendations to senior management and governance committees.
Key Principles:
- Strategic Leadership: Provide strategic leadership in integrating security into the Software Development Life Cycle (Secure SDLC) and managing vulnerability programs, ensuring alignment with organizational objectives.
- Empowering Teams: Empower and support team members in their roles, promoting a culture of accountability, innovation, and excellence in security practices.
- Holistic Security View: Adopt a holistic approach to security, considering the full spectrum of vulnerabilities, threats, and mitigation strategies in the organization’s security posture.
- Stakeholder Engagement: Engage effectively with stakeholders across the organization, ensuring that security priorities are communicated, understood, and supported at all levels.
Qualifications:
- Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related field.
- 8 to 12 years of extensive experience in information security, with significant experience in leadership and team management roles.
- Minimum of two advanced security certifications such as CISSP, CISM, CISA, GCED, CeH, or Azure Security.
- Proven experience in developing and managing secure SDLC processes and large-scale security programs.
- Deep understanding of vulnerability management, penetration testing methodologies, and application security assessments (SAST, DAST, IAST).
- Strong knowledge of security frameworks, standards, and compliance requirements, including NIST 800-53, the NIST Cybersecurity Framework and OWASP.
- Proficiency in security technologies and tools, as well as a solid understanding of networking, operating systems, and application development.
- Demonstrated leadership abilities with experience in building and leading high-performing security teams.
- Exceptional communication, negotiation, and interpersonal skills, with the ability to influence and engage stakeholders at all levels.
- Strong strategic thinking and problem-solving skills with a focus on proactive and innovative security solutions.
- Experience in cybersecurity risk management and developing organizational security strategies.
Preferred Skills:
- Experience in the banking or financial services sector.
- Familiarity with cloud security architectures and services.
- Proven track record in managing cybersecurity incidents and responses.
- Experience in budgeting and resource allocation for security programs.
Problem Solving:
- Holistic Security Problem Solving: Approach security problems with a holistic perspective, considering the broader impact on the organization and ensuring that solutions align with business objectives.
- Leadership in Crisis: Lead the organization through security crises, providing clear direction and making decisive, informed decisions under pressure to mitigate risks.
- Innovative Solutions: Drive innovation in solving security challenges, exploring new technologies, methodologies, and approaches to stay ahead of emerging threats.
- Balancing Priorities: Solve problems by balancing immediate security needs with long-term strategic goals, ensuring that solutions are sustainable and support the organization’s growth.
- Mentorship and Development: Mentor and develop team members’ problem-solving abilities, fostering a proactive and innovative mindset within the security team.
