TS&O Senior Cyber Security Officer

At HEINEKEN Kraków (Heineken Business Services Poland) our success comes directly from our great people. We are a growing team of business experts in finance, accounting, data and technology ready to „WOW” the world with our expertise, passion and pride to be GREEN. We act on our values of Passion for consumers & customers, Courage to dream & pioneer, Care for people & planet, Enjoyment of Life, always focused on being ourselves: inclusive, diverse, and open for new challenges.

The Cyber Security Officer actionize the strategic direction, policies, governance designed by GIS and controls to ensure the effective delivery of a high-quality Information Security service for HEINEKEN. As a member of the TP&S Hub Information Security team, the Cyber Security Officer will be the subject matter expert for all matters around information security, be a member of incident response team in the event of a security breach and be one of the main contacts for OpCo (Operational Companies) stakeholders. In addition, the role holder has joint responsibility for Control processes including audit, security, business continuity and regulatory compliance across D&T.

Your responsibilities would include:

• Security Operations

o Implement global security strategies to maintain the continuity of systems and update these based on local threats.

➢ Responsible to manage updates related to OpCo Security Standards that are required due to local legislative requirements, in consultation with the relevant Global Information Security (GIS) teams in line with HEINEKEN Security Strategy and supporting the HEINEKEN Business Strategy.
➢ Responsible for local security approvals regarding global services (e.g. HeiNet), in order to maintain the highest level of security for the information and IT assets of the company.
➢ Assist the global operational security team in the design of controls/ standards and procedures that have broad implications, requiring systems integration of one or more technical platforms.
➢ Perform Risk reviews using the risk management procedure for all new local programs/services to be deployed in the OpCo operational environment and veto programs which do not comply with HEINEKEN’s security standards.

o Monitor internal and external information security and cyber security policy compliance, review and assess information security audits.

➢ Performs, as per the prescribed frequency the Security Controls Effectiveness Assessment (SCEA) and ensures that all related evidence is available in support of the assessment.
➢ Monitor and ensure the timely closure of tasks related to audit and internal control issues raised by e.g. Global Audit, SCAR, etc.

o Develops and manages the Information Security action plan to address identified risks and non-compliances.

➢ Gains approval from the relevant management team on that action plan and its related budget;
➢ Monitors and reports on the execution of that actions plan, reporting locally to the local management team and centrally to the GIS / CDO team.
➢ Analyse and challenge derogation requests regarding the ISP and TSPs that OpCos could have with a new solution or program and communicate same to the global security operations and risk management teams for approval in order to protect the HEINEKEN security environment.

o Drive resolution of cyber security incident responses and address security vulnerabilities.

➢ Perform/guide/drive digital investigations upon the request of Local OpCo/ TP&S Hub /HR or Legal teams in case of breaches of HEINEKEN’s Code of Business Conduct.
➢ If the OpCo faces any critical IT security incidents or breakout, he/she is responsible as the local security incident lead to resolve with the OpCo D&T Managers and TP&S Hub in consultation with the Cyber Defense Operations Team (CDO), IT Regional Directors and Service Line Managers.
➢ Identify and perform independent analysis to resolve complex first-time issues including the analysis of technical and economic feasibility of proposed security systems/ solutions. He/she is also responsible to assist the global security operations team for any IT technical audit (e.g. Ethical Hack) to any OpCo IT infrastructure or service that a 3rd Party offers to HEINEKEN with a valid and open contract to ensure that security policies are in place.
➢ Advises OpCo and TP&S Hub operations teams for security requirements (e.g. Patching, Anti-Virus, Vulnerability Management, etc).

• Security Awareness:

o Drive training campaigns on cyber security awareness according to the global security awareness program and based on the local OpCo
reality. Manage and train cyber security staff.

• Security Strategy

o Responsible for identifying potential risks and recommendations on how to prevent and/or avoid that risk for inclusion in global operational security strategy.
o Collaborate with the Global security product teams to understand and develop further the controls and processes required to improve
information security.

• Innovation

o Accelerates and Drives implementation of new Security strategies and standards from global D&T towards the HEINEKEN OpCos
o Research / participate in peer security forums (3rd parties and peers Companies) to identify opportunities to benchmark and continuously improve local implementation of standards and best practices from across IT or from the marketplace
o Provide security expertise across multiple technical platforms to various OpCo and TP&S Hub stakeholders in all phases of solutions development (Ideation, Design, build, test and deploy) and Operations.

• Operational Technology – Process Control Domain

o Security Incident Management coordination.
o Control Self-Assessment coordination.
o Assist with the review and closure of Information Security Issues.
o Review execution of PCD security deliverables (patch compliance, AV, backups, etc.).
o Support OpCo communications and roll out of security standards, procedures, etc.
o Engage and collaborate on best practices with other CSOs and PCD Security Leads with an emphasis on standardization and simplification.

You are a good candidate if you have:

• 7+ years working experience in Cyber Security area
• Support for other CSOs
• Responsibility for cybersecurity of Operating Companies that are accountable for >12% of European revenue
• 5+ years of experience of working in agile teams in multi-cultural environments
• 5+ years of working with senior business stakeholders, influencing and working with OpCo’s
• Bachelors or Master’s degree in Information Security or relevant subject
• A strong technical background with experience in one or more IT areas
• Experience of technical disciplines in relation to Information and Cyber Security management
• Experience of working with relevant standards such as ISO 27001, COBiT and relevant laws and regulations such as privacy laws including GDPR
• Experience of managing audit and control processes within a technology context
• Certification or formal training in ITIL
• Ability to work in a cross functional environment and preferably experience in FMCG
• Capable of managing multiple conflicting priorities and deadlines in a matrix environment with rapid change
• Good interpersonal skills, oral and written communication skills, relationship management and influencing skills
• Ability to build and leverage personal and professional networks
• Working within a local and global matrix context
• Strong attention to detail, independent judgment and decision-making
• Experienced in self-developing through continuous learning, sharing best
practice, knowledge and expertise
• Excellent written and verbal English
• Other languages would be welcomed

Nice to have:
• Certification in relevant IT Security discipline (e.g. CISA, CISM, CISSP, CEH) is nice to have

We Offer: