信息安全项目经理岗位职责

Job Description
Responsible to support Regional Information Security Risk Governance fthe Asia zone to ensure the Security posture of business units are properly measured, monitored managed Assist in the development promotion of of Information Security policies, standards, procedures according to the industry best practices standards (e.g. NIST800-53, , NIST Cyber Security Framework, ISO27000, CIS, ISA/IEC62443, etc.), technologies, relevant regulatory group requirements Evaluate manage capabilities that enable theganization to reliably achieve objectives, address uncertainty act with integrity, as a whole more responsive efficient in a consistent manner Act as the main responsible party to drive align the policy compliance across Group, business units business lines toward the same direction. Perform manage regular Information Security Control assessment to ensure that business units are compliant with the Group Information Security Policies Standards Manage remediation activities from Security assessments audit findings to mitigate the risks Identify address cyber risks requirements inder to protect theganization from adversity, surprise weakness MonitInformation Security Risk control, test to determine the control performance effectiveness with continuous improvement of KPIs. Support the Cyber Security project implementation daily activities with respect to Information Security best practices risk assessments Qualification (Public fHiring) At least 5 years hands-on experience in IT Security, Governance Risk Management, with 2 years in managerial team position Extensive knowledge understanding of Information Security framework, such as ISF, ISO27001, NIST Cyber Security Framework. Sound knowledge of Information System, IT Operation IT Audit Knowledge on OT Security. Good stakeholder engagement management skills Great sense of ownership servicing mindset Strong liaison skill, teamwork, passion commitment mentality Strong self-motivation, with good leadership, interpersonal analytical skills, lead through influence, communicate effectively to stakeholders on risk management cyber security governance Strong problem solving project execution skills; able to handle changing priorities drive difficult decisions; highly dependable team player with ongoing commitment to excellence Relevant professional certification, such as CISSP, CISA, CISM, CRISC CGEIT is desired Good communication in English Mandarin,

岗位职责:
1、负责参与完善公司安全项目全生命周期安全防护工作，包括网络安全、应用安全、数据安全、运营安全等；协助配合制定相关安全标准和要求；
2、输出安全解决方案和安全评估报告，针对其中安全隐患、漏洞等问题输出修复方案并跟进落地；
3、负责配合方案团队提供安全合规咨询及解决方案，支撑内外部客户安全合规能力建设。

任职要求:
1、信息安全、计算机、通信或相关专业本科及以上学历，具备网络安全相关工作经验；
2、负责相关安全系统的运营和维护，包括防火墙、WAF、漏洞扫描、高防-AntiDDos等，针对系统的配置和出现的问题提出解决方案，跟踪分析和实施。了解APT攻击、黑灰产攻击，熟悉各类入侵思路、攻击手法与工具，具备实战对抗经验；
3、具备漏洞扫描、漏洞挖掘、渗透测试相关工作技能；
4、了解网络安全相关标准，如ISO27001/27001 等保2.0、DSMM等国标、行标；
5、具有CISP、CISAW、CCSK、CISA等职业证书优先；
6、具备团队管理、项目管理经验者优先；
7、具备良好的团队沟通、协作能力、良好的职业道德，高度的责任心。

【职责描述】：
1.负责落实和执行上级单位和公司有关信息化安全要求要求，对接并完成上级主管机关下发的信息安全相关任务。
2.负责制订、落实公司信息安全政策、制度和技术标准；
3.建立健全公司信息系统安全防护体系；
4.监测公司信息安全管理水平和安全隐患，制定相应应急预案并定期演练，积极预防及处理信息安全事件；
5.指导网络硬件、软件开发等技术人员，实现符合安全等级保护工作标准或产品；
6.负责研究跟踪信息科技安全动态，掌握运用有效的网络攻防技术；
7.负责公司日常信息安全事件处理；
8.负责公司信息安全项目相关的事宜。
【任职要求】：
1.计算机/信息安全本科或本科以上，5-8年信息安全经验，有良好的文档处理能力；
2.精通信息安全评估理论，熟悉安全加固和安全审计技术，有丰富的实践经验；
3.掌握主要软硬件的信息安全点和攻防技术，熟悉安全控制技术并运用相关工具；
4.精通网络架构设计，熟悉路由器、防火墙、IDS/IPS/WAF等配置及数据加密技术；
5.良好的团队协作能力和学习能力。