Head of Information Security & IT Operations

We are looking for an experienced and hands-on Head of Information Security & IT Operations to oversee the company's information security and corporate IT functions.

• This role strengthens cybersecurity controls, manages information security risks, oversees corporate IT operations, and protects company systems, networks, employee devices, accounts, and sensitive business information.

• The successful candidate will lead the IT Support function, establish effective security policies and practices, coordinate security incident responses, and drive continuous improvements in the company's overall security posture.

• This position reports directly to the CEO and works closely with the CTO and other departments to ensure security risks are properly managed, and business operations remain secure and reliable.
  

Job Responsibilities:

• Information Security Management
  - Develop, implement, and maintain company-wide information security policies, procedures, and standards.
  - Identify and assess security risks across the company's systems, operations and business processes.
  - Conduct regular security reviews and work with relevant departments to address identified risks.
  - Establish security controls and ensure they are properly implemented and maintained.
  - Maintain a security risk register and provide regular updates to management.

• Corporate IT & Account Security
  - Oversee the security of employee computers, corporate devices, Google Workspace and other business applications.
  - Establish and enforce access control policies, including MFA, privileged access, and user permission management.
  - Work with IT Support and relevant teams to strengthen endpoint protection, malware prevention, and device security.
  - Review employee access rights regularly and ensure proper access management during onboarding, internal transfers, and resignations.
  - Monitor and address suspicious account activities, unauthorized access attempts and potential account compromises.

• Corporate IT Operations & Team Management
  - Lead and oversee the IT Support function to ensure reliable, secure, and efficient daily IT operations.
  - Supervise the management and maintenance of company hardware, software, office networks, firewalls and internet connectivity.
  - Provide technical guidance on network and firewall security, including access controls, firewall policies, VPN security and network segmentation.
  - Ensure appropriate endpoint protection, system updates, IT asset management and preventive maintenance practices are in place.
  - Establish IT service standards, escalation procedures and backup arrangements for critical IT operations.
  - Oversee corporate IT vendors, service providers, maintenance contracts and related operational costs.
  - Work closely with the Technology team on shared infrastructure, network security, and technical issues requiring cross-team coordination.

• Security Monitoring & Incident Management
  - Establish and improve security monitoring, alerting, and incident reporting processes.
  - Oversee the detection and investigation of phishing, malware, brute-force attacks, credential compromise, and other cybersecurity threats.
  - Coordinate with the Technology team and relevant departments during security incidents to ensure timely investigation, containment, and recovery.
  - Review security incidents, identify root causes, and follow up on corrective and preventive actions.
  - Establish incident response procedures and escalation protocols.

• Security Risk Assessment & Compliance
  - Work closely with the CTO and other technical teams to review security risks affecting critical business systems.
  - Assess security controls for sensitive information, digital inventory, payment operations, and third-party integrations.
  - Coordinate security assessments, vulnerability reviews and penetration testing where necessary.
  - Ensure appropriate security practices are in place to support applicable regulatory and data protection requirements.
  - Monitor the implementation and effectiveness of security improvements.

• Security Awareness & Third-Party Management
  - Conduct cybersecurity awareness training and phishing prevention programs for employees.
  - Establish guidelines for handling confidential information, passwords, and sensitive business data.
  - Assess security risks associated with suppliers, service providers, and other third parties.
  - Work with relevant departments to strengthen security practices and reduce operational risks.

• Security Strategy, Budget & Continuous Improvement
  - Develop and maintain the company's information security strategy and improvement roadmap based on business needs and identified risks.
  - Assess existing security capabilities and recommend improvements to strengthen the company's overall security posture.
  - Establish security priorities, performance indicators, and regular management reporting.
  - Plan and manage information security and corporate IT budgets, ensuring effective allocation of resources.
  - Evaluate and recommend security solutions, tools and external service providers based on effectiveness, cost and business requirements.
  - Identify staffing needs and build the information security team as the business grows.
  - Monitor the progress and effectiveness of security initiatives, ensuring identified risks and weaknesses are addressed.
  - Work closely with the CTO and department heads to continuously improve security practices and operational resilience.
  

Job Requirements:

• Minimum 7 years of relevant experience in information security, cybersecurity operations, or IT security.

• At least 2 years of experience in a supervisory, team leadership, or security management role.

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Security, or a related field.

• Strong knowledge of information security principles, risk management, and security operations.

• Strong understanding of network and firewall security, including firewall policies, network segmentation, VPN security, access controls, and security logging.

• Ability to review firewall configurations, identify security weaknesses, and provide technical guidance to IT Support or external service providers.

• Hands-on experience in endpoint security, identity and access management, email security, and incident response.

• Experience in investigating cybersecurity incidents involving phishing, malware, unauthorized access, or compromised accounts.

• Familiarity with security solutions such as firewalls, EDR/XDR, SIEM, and vulnerability management tools.

• Good understanding of network security, cloud security and corporate IT environments.

• Familiarity with ISO 27001, NIST Cybersecurity Framework, and relevant information security standards.

• Strong analytical, problem-solving, and communication skills.

• Able to work independently, manage priorities, and coordinate effectively with different departments.