CISO

About the role

Define, lead, and supervise IESE's cybersecurity strategy, ensuring an adequate level of protection for the institution's digital systems, data, and services.

The CISO will be responsible for identifying and managing the main cybersecurity risks, establishing policies and controls, coordinating incident response, and ensuring that security is integrated into the technological architecture, projects, and daily operations.

What you'll do

• Define and maintain the long-term cybersecurity roadmap and the annual Security Master Plan.

• Identify, evaluate, and prioritize cybersecurity risks.

• Define security policies, standards, and controls.

• Supervise the implementation and effectiveness of security controls.

• Coordinate cybersecurity incident management and response and recovery plans.

• Lead the management of vulnerabilities, threats, and technological risks.

• Ensure that security is integrated by design into new projects, applications, and services.

• Evaluate cybersecurity risks associated with providers and external services.

• Coordinate audits, security reviews, and remediation plans.

• Drive cybersecurity awareness and training programs for users.

• Define and monitor cybersecurity KPIs and KRIs.

• Report periodically to Management on risk levels, relevant incidents, and the evolution of the security plan.

What we're looking for

• previous performance of CISO functions or equivalent responsibility.

• leadership of cybersecurity, technological risk, or security governance committees, involving management profiles and business areas.

• cybersecurity management and governance in complex organizations.

• technological risk management.

• definition of policies and controls.

• incident response.

• security in primarily Microsoft environments and cloud services.

• vendor management.

• communication with technical teams and management.

• real experience working with cybersecurity frameworks such as ISO 27001, NIST Cybersecurity Framework, or equivalents.

Nice to have

• Cross-functional leadership capacity.

• Risk vision and prioritization.

• Ability to translate technical risks into business impact.

• Practical orientation and capacity for execution.

• Good level of communication with Management and users.

• Ability to influence without the need to have all teams under direct reporting lines.

• Judgment to balance security, user experience, and agility.