Head of Information Security

Responsibilities:

Strategy & Planning

·       Develop and execute implementation of near and long-term security strategy and goals in alignment with business objectives and culture

·       Drive security risk analysis, mitigation, and remediation plans. Plan for and lead security incident response and recovery efforts.

·       Manage the development and implementation of security policy, standards, guidelines and procedures to ensure ongoing maintenance of security. Information protection responsibilities will include network security architecture, network access and monitoring policies, employee education and awareness

·       Create and communicate security strategies and plans to the executive team, staff, partners, customers, and stakeholders

·       Design and implement disaster recovery and business continuity plans, procedures, audits, and enhancements

·       Develop, implement, maintain and oversee enforcement of policies, procedures, and associated plans for system security administration and user system access based on industry-standard best practices

·       Response and provide support to the customer with respect to information security

Operational Management

·       Build a world-class team of security professionals; build the company into a well-known, highly desired employer for security professionals

·       In conjunction with the engineering team, develop and support secure coding practices and procedures. Direct application-level security review for new and existing functionality

·       Oversee incident response planning as well as investigation of security breaches, and assist with disciplinary and legal matters associated with such breaches as necessary

·       Act as advocate and primary liaison for the company’s security vision via regular written and in-person communications with the company’s executives, department heads, and end users

·       Work on corporate technology development to fully secure information, computer, network, and processing systems

·       Manage the administration of all computer security systems and their corresponding or associated software, including firewalls, intrusion detection systems, cryptography systems, and anti-virus software

·       Manage the administration of the facility’s security systems and their corresponding equipment or software, including fire alarms, locks, intruder detection systems, sprinkler systems, and anti-theft measures

·       Track and control the security services annual operating and capital budgets for purchasing, staffing, and operations

·       Ensure that facilities, premises, and equipment adhere to all applicable laws and regulations

·       Recommend and implement changes in security policies and practices in accordance with changes in applicable laws and regulations

·       Creatively and independently provide resolution to security problems in a cost-effective manner

·       Assess and communicate security risks

·       Lead operational risk management activities to enhance the value of the company and its brand

·       Work with outside consultants as appropriate for independent security audits

·       Collaborate with the technology leader and human resources to establish and maintain a system for ensuring that security and privacy policies are met

·       Promote and oversee strategic security relationships between company employees and external entities, including government, vendors, and partner organizations

·       Remain informed on trends and issues in the security industry, including current and emerging technologies and prices

·       Employ sound security practices to preserve security, integrity and confidentiality of client data, and inform the CEO of security violations and resolutions

·       Maintain relationships with local, state and federal law enforcement and other related government agencies

Qualifications:

·       10+ years of experience managing and/or directing an IT and/or security operation

·       Proven experience in planning, managing or developing IT security and facility security system technologies

·       Experience in planning and executing security policies and standards development

·       Excellent knowledge of technology environments, including information security, building security, and defense solutions

·       Considerable knowledge of business theory, business processes, management, budgeting, and business office operations

·       Substantial exposure to data processing, hardware platforms, enterprise software applications, and outsourced systems. Good understanding of computer systems characteristics, features, and integration capabilities

·       Demonstrated ability to apply IT in solving security problems

·       In-depth knowledge of applicable laws and regulations as they relate to security

·       Proven leadership ability

·       Equip with security certificate is preferable (e.g. CISSP, CISM, ISO27001)