IT Security Officer (ITSO)

ITSO – IT Security Officer

Responsibilities and Requirements

· At least 5 years combinedwork experience in software development, application security and cloud computing (e.g. AWS)

· Good understanding of mobile and web application architectures, including APIs and related technologies and protocols suchas REST, SOAP and SSL/TLS.

· Strong knowledge of application securityprinciples and industrybest practices, including the OWASP Top 10 and OWASP Application Security VerificationStandard (ASVS).

· Familiar with Agile development, CI/CD and DevSecOpspractices, including tools such as GitLab,GitHub and Ansible, and the integration of automated security testing intoCI/CD pipelines.

· Experience in using SAST code scanning tools such as Fortify-on-Demand, Sonarqube, etc

· Review system architecture, data flows, interfaces, APIs, internet-facing entry points and securitycontrols to identify potential security risks.

· Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloudservices.

· Preferably possess experience in threat modellingand develop threatprofiles for application projects to identify, quantifyand remediate application security risks.

· Review remediation plans and supporting evidence to verify that securityrisks have been adequately addressed.

· Track and addresssecurity vulnerabilities with timely remediation and patching and closure in accordance with establishedrequirements.

· Monitor and investigate cybersecurity alerts and incidents, includingmalware, phishing, account compromise, data breaches,unauthorised access, and cloud security incidents.

· Perform cybersecurity incident response andmanagement, including incident triage, investigation, containment,remediation, recovery, and post-incident review.

· Conduct security awarenesstraining sessions to promote securityawareness and good cybersecurity practices.

· Good verbal/written communications, collaboration skills and experience interacting with various stakeholders

· Strong analytical, problem-solving and troubleshooting skills, ability to work independently

· Degree in relevantdiscipline, or an equivalent qualification.

· Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS security certification orequivalent are preferred

· Experience in workingwith Government Commercial Cloud (GCC) preferred.