Information Security Specialist

JOB SUMMARY:

Under the direction of the Chief Information Security Officer (CISO), manager/head, incumbents assigned to this classification ensure the secure operation of the in-house IT information systems, servers, and network connections. The Information Security Specialist 2 will assist in detecting, investigating, and defending against information security incidents targeting the bank's IT systems and data. This includes checking server and firewall, log management, scrutinizing network traffic, establishing and updating virus scans, and troubleshooting. The incumbent will also analyze and resolve security breaches and vulnerability issues in a timely and accurate fashion, and conduct user activity audits where required.

DUTIES AND RESPONSIBILITIES

1. Assist with the assessment and update of the enterprise-wide information security handbook and pertinent policies that are appropriate for the bank's existing and future risk-taking operations.

2. Demonstrate an independent concurrence to the presence of information security risk management structure in policies issued by the bank.

3. Provides independent opinion on inherent information security risks that may arise from proposed business plans, projects, and processes.

4. Assists in monitoring reports on the bank's information security risk exposures relative to its defined risk limits through regular business unit risk reports, self-risk assessments, and defined key risk indicators.

5. Assists the CISO in leading the implementation of the bank-wide Information Security Risk Assessment.

6. Investigates, identify, and assess information security risks or exposures on new and existing infrastructure systems, and recommend appropriate controls.

7. Analyzes security incidents and the escalation of security events.

8. Monitors the security tools, reports, and logs and analyzes their potential impact

9. Evaluates and keep track of adherence to information security guidelines.

10. Directing or assisting in the execution of information security programs or initiatives primarily securing the online assets of the bank.

11. Promotes and supports programs that raise awareness of information security that are suitable for the bank's dynamic working environment. Such activity includes: o Periodically provides training and awareness campaigns for information security risk management o Performs periodic evaluation (e.g. bank-wide awareness assessment) of the effectiveness of information security risk management awareness and training programs. o Periodically conduct Vulnerability Assessment and Penetration Test (VAPT) across the Bank's IT Assets and facilitate the remediation procedures.

12. Constant periodic review and benchmarking of information security processes, seeks to standardize and streamline information security risk management processes, improves productivity, and adopts best practices.

13. Ensures attendance to relevant information security training programs and information security professional certification, if any.

14. Ensure the regulatory compliance and adherence to information security-related laws, rules, and regulation.

15. Scanning and uploading of policies, procedures and reports to Network Attached Storage Server (NASSVR).

16. Perform duties and responsibilities required under the latest manual of operations pertaining to the position.

17. Perform other task that maybe assigned from time to time by the management.

MINIMUM REQUIREMENT

Education:

Graduate of at least four (4) years Bachelor’s degree/College degree course in Information Technology (e.g Computer Science, Computer Engineering, Electronic, and Communication Engineering (ECE), etc.), Security Studies.

Experience:

Minimum of 2 yrs. experience as a cybersecurity specialist with proficiency in VAPT or Ethical Hacking Knowledge in IT Risk Management and IT Security Management.

Knowledge of Information Security Management Systems (ISMS, (International Organization for Standardization (ISO) 27001)

Knowledge in Business Continuity Management (BCM, International Organization for Standardization (ISO), Payment Card Industry Data Security Standard (PCI DSS, National Institute of Standards and Technology (NIST), Center of Internet (CIS))