Consultant - Information Security
Summary
Information security consultant embedded with SJC IT in Doha, maintaining security across infrastructure and networks: coordinating vulnerability assessments and pen tests, incident response, SOC monitoring, and compliance with ISO 27001 and Qatari cyber laws; requires 5-8 years' experience and certs like CISM/CISSP.
Consultant - Information Security role is responsible to maintain information security management within the Infrastructure & Network and continue security controls to maintain adequate cyber security posture within the environment and support manage IT Information Security Lead.
• Working with Infrastructure, Network, and Service Operations teams to ensure the security of SJC IT infrastructure, networks, and service operations.
• Coordinate with vendors and conduct vulnerability assessments and penetration testing for infrastructure and networks.
• Coordinate with the Cybersecurity Engineer – Governance and Risk Management to maintain infrastructure and network security management policies, procedures, and risk management.
• Assist in developing, implementing, and managing the overall enterprise infrastructure processes for information security and associated architecture standards, such as ISO 27001, NIA, Cyber Security Law, Privacy Management Law, and Qatar 2022 Cyber Security Requirements.
• Evaluate suspected security breaches and recommend corrective actions, including incidents involving external vendors.
• Follow the cyber security incident management and incident response plan.
• Serve as part of the security incident response planning and execution.
• Assist Risk Management, Internal Audit, and the IT department in developing appropriate criteria to assess the compliance levels of new and existing applications and/or technology infrastructure elements against enterprise security standards.
• Assist in reviewing infrastructure and/or technology environments during the development or acquisition process to (a) ensure compliance with corporate security policies and directions and (b) assist in the overall integration process with SJC IT’s existing technology environment.
• Evaluate information security KPIs based on the Information Security/Privacy Objectives and review those KPIs based on changes to the security objectives.
• Maintain infrastructure and networks to support the organization’s information security/privacy policies and procedures, and ensure their timely updates in light of changing circumstances, best practices, and regulatory directives.
• Conduct security assessments to maintain an adequate security posture within the SJC IT environment.
• Improve Security Operations Center monitoring based on the evolving cyber security environment and emerging attacks.
• Work with the Head of Information Security to coordinate with the MOI Security Shield and maintain NCSOC onboarding and continuity of connectivity.
• Work with the Head of Information Security to coordinate with the MPTO team and maintain Qatar 2022 implementations based on the agreed roadmap.
• Provide daily, weekly, and monthly reports to the Information Security Lead related to infrastructure and network environment changes, incidents, problems, service operations, and critical areas.
Mandatory Actions -
• IT Security Team Meeting – Monthly Basis.
• Risk Register Validation – Monthly Basis (until the IT environment reaches a stable state).
• Information Security KPI Validation – Monthly, Quarterly (Reporting), Bi-annual, and Annual.
• Compliance Management – NIA, Qatar 2022, NCSOC, Q-CERT, ISO 27001:2013, Cyber Crime Law, Privacy Law, and other applicable laws and regulations relevant to SJC IT.
| Competencies | ||
Technical Competencies: | ORGANIZATION Values: | |
|
| |
| 4. Key Business Interactions | ||
| Internal | External | |
|
| |
| 5. Qualifications & Experience | ||
| Required Qualifications: | ||
| ||
| Preferred Experience: | ||
| ||