Required skills:

• 12+ years of experience in Information Security
• 3+ years of leadership experience, either as a people manager or a actively coaching / mentoring engineers.
• Subject matter expertise in KPI
• Excellent verbal, written, and interpersonal communication skills.
• Ability to provide strong customer service.

Preferred Skills

• Security certifications such as CISSP, CISM, CISA, CRISC, AWS, Azure, SANS, etc.

Job Description

• Maintenance of ISMS ISO 27001 documentation.
• Security Training - Deliver account security training programs and material as required by customer contract to relevant Fujitsu staff or Fujitsu aligned Third Parties who are part of the service flow down.
• Security Clearance: Check and confirm that resources have the appropriate clearance when access requests are made (for e.g. checks for new user access privileges against approved AD and Azure PAM matrices). Report on security clearance status levels to the ISM and account team and customer when required.
• Privilege Access Management Manage and operate the Privilege Access Management process for all customers. Monitor, validate and report on access levels including the creation of the monthly reports against the PAM process and provide to customer and account. The ISM shall still approve the access requests. The ISM shall continue to hold discussions with customer on access compliance state.
• Audit Exercises, IT Health Checks and Security Questionnaires
• Security Policies:

• • Disseminate updates in customer security policies and procedures to relevant Fujitsu account staff and relevant stake holders when notified by the customer or Information Security Manager.
  • Review changes and updated to customer security policies and procedures to identify if services or working practices are required to be modified if Fujitsu is contracted to abide by customer security policies and procedures, where there is work to assist the ISM with the engagement and improvement exercise activity with ATC and account team.
  • The ISM shall be put in copy for awareness, the ISM shall continue to have a solid working knowledge of all customer policies and procedures which are to be complied with as part of service delivery.
  • Disseminate CTI security Advisories as they are provided.
  • The ISM shall be put in copy and shall continue to hold discussions with customer on threat landscape and threat actors.

• Vulnerability Management Reporting

• • Manage the Vulnerability Management service reporting.
  • Collect the vulnerability scan reports from the ATC/GDC teams and reconfigure the reports where contracted and required to meet the customers’ requirements.
  • Review and highlight the gaps to the team and have the mitigation in place.

• Incident Management –

• • Managing end to end Security Incident and providing a report to the required stake holders for further actions.

• • Participate with Security Investigation discussions when required and participate in bridge calls.
  • Gather evidential information to enable investigation.
  • Help to identify and escalate and transform security findings into Incident or Change Requests or for relevant action by stake holders.

• Change Management – Analyse and approve Change request Assessments when required.

• • Review change requests and provide input into risk assessment of changes, assist with the assessment of all proposed infrastructure and procedural changes to ensure that all relevant security standards are maintained.
  • The ISM will continue own the change request service line item.
• Monitoring security compliance through ongoing security control reviews and risk assessments
• Investigating and analysing security breaches and, where appropriate, liaison with funding bodies and other stakeholder groups requiring information and reports on security incidents.

• Working with Information Security infrastructure owners to implement any Information Technology security programme.
• Cultivation, of business relationships, review, and interpretation of new sources of information on current and emerging laws, rules, regulations, and industry practice relating to Information Security
• Planning, organising, and performing (ISO 27001:2013) internal audits.
• Managing and maintaining Risk Registers and Risk owners
• Assisting with the development and maintenance of policies based on audit findings.
• Assisting with the support and ongoing maintenance of the ISO 2700 parameters.
• Assisting with tracking and investigating information security incidents
• Contribution to Information Security strategy, overseen by the Higher Management.