About the company
The organization is a professional entity focused on maintaining a structured and effective security posture. It operates as part of a larger group structure, meaning local execution and implementations must align with the broader group's central Security & Resilience requirements. The company also operates in an environment where industrial cybersecurity standards, such as IEC 62443, are valued.
About the job
...
The Information Security Officer (ISO) is responsible for managing, maintaining, and continuously improving the organization's Information Security Management System (ISMS) to ensure compliance with ISO/IEC 27001 and related ISO 27000 standards. The core focus of the role includes information security governance, risk management, compliance, and audit readiness.
Primary responsibilities include:
- Conducting information security risk assessments, maintaining risk registers, and tracking mitigation actions.
- Coordinating internal audits and external ISO certification audits, as well as tracking remediation activities.
- Developing and maintaining security procedures, standards, and documentation.
- Driving security awareness and training initiatives for employees.
- Assessing the security impact of system changes and working with ICT teams to implement necessary controls.
About the requirements
Manager / Team Structure:
The position is located within the ICT Department and reports directly to the Chief Information Security Officer (CISO). The ISO will work closely and coordinate with the CISO's wider team, the Head of ICT, ICT Engineers, the Total Quality Management Department, and the company's IT users.
Role Requirements:
- Education: Minimum Diploma or Degree in Computer Science, Information Technology, Cybersecurity, Engineering, or an equivalent field.
- Experience: 3 to 5 years of relevant professional Information Security experience.
- Knowledge & Skills: Strong working knowledge of the ISO/IEC 27001 ISMS framework, risk assessment methodologies, and audit processes. Must possess a solid technical understanding of IT infrastructure, networks, and security attacks/controls. Professional certifications (e.g., CISSP, CISM, CISA, or ISO 27001 Lead Implementer/Auditor) are an advantage.
- Attitude: Requires a highly accountable, problem-solving mindset with strong coordination, communication, and stakeholder engagement skills.
