信息安全咨询顾问（Information Security Consultant）

该职位来源于猎聘 Objective of job Ensure that the organization and IT assets follow the security standard and governance. You monitor and identify vulnerabilities in systems, threats and issues, document it and track the remediation. Develop and implement cloud security strategies. -Responsible for the governance of compliance with policies and processes to protect the confidentiality, integrity and availability of IT assets (information, data and IT services) within the organization. -Responsible for organizational and technical controls -Support in risk assessment and analysis and monitoring the implementation of risk control/minimization measures -Identification of possible vulnerabilities in services and applications. Ordering and monitoring of penetration and assessment services. Document the results and ensure mitigation/minimization -Assessing threats and developing appropriate security measures and assessing their effectiveness -Assist businesspartners in information classification -Coordination for security incidents and participation in incident response activities, including mitigation and remediation strategies [3] -Take care of actuality of disaster or application recovery plans -Develop and conduct target group orientated awareness campaigns -Define security controls derived from policies Job designation

• Developing and Maintaining Security Policies and Standards

Responsible for creating, updating, and enforcing information security policies, standards, and procedures that align with legal, regulatory, and contractual requirements. This includes ensuring that policies are comprehensive, clearly communicated, and regularly reviewed.

• Ensuring Regulatory Compliance

Ensure the organization complies with relevant laws, regulations, and industry standards such as ISO 27001, NIST, and others. This involves understanding the specific requirements of each regulation and implementing controls to meet them.

• Security Audits and Assessments -Responsible for planning and conducting internal security audits to assess the effectiveness of security controls and identify areas for improvement.
• Coordinate external audits and assessments, ensuring the organization is prepared and responsive to auditor requests.
• Risk Management and Governance -Identifying, assessing, and managing information security risks across the organization. This includes conducting regular risk assessments, developing risk mitigation strategies, and monitoring the effectiveness of controls.
• Contribute to the development of a strong governance framework for information security.
• Compliance Reporting Responsible for preparing and submitting reports to management and regulatory bodies on the organization's security posture and compliance efforts. This includes tracking key security metrics, documenting compliance activities, and communicating security risks and issues to relevant stakeholders.
• Policy Enforcement Responsible for ensuring that security policies are consistently enforced across the organization. This includes monitoring compliance with policies, investigating security violations, and taking corrective action when necessary
• Supplier Risk Management Assesses the security practices of third-party suppliers and service providers to ensure they meet the organization's security requirements. This includes reviewing vendor contracts, conducting security assessments, and monitoring vendor compliance with security policies
• Collaboration and Communication -Collaborating with other IT teams, developers, and business stakeholders.
• Providing security training and awareness to employees. -Communicating security risks and recommendations to management. Qualification
• Professional Skills:
• Deep understanding and experience on: IT Security, Risk Management, Compliance & Security Standards, Knowledge in all relevant Operating Systems, Data Protection -Knowledge of: Cloud Security, Network, Web Technologies, Database, IT operations (ITIL)
• Experience with security frameworks, such as NIST, and ISO 27001.
• Relevant certifications, CISA, CISSP
• ＞ 5 years experience with focus in areas of security governance and security operations Education: Bachelor's degree and above in Computer Science encompassing Information Security 职位目标 确保组织及IT资产符合公司安全标准和治理要求。识别并监控系统漏洞、潜在威胁及安全问题，进行记录并跟踪整改。同时，制定并实施云安全策略。 岗位职责 1. 信息安全治理与控制 负责确保组织内部IT资产（信息、数据及IT服务）的机密性、完整性和可用性（CIA）符合相关安全政策与流程 负责制定和实施组织层面及技术层面的安全控制措施 根据安全策略定义并落实安全控制要求 2. 风险管理与安全评估 支持信息安全风险评估与分析，并跟踪风险缓解/控制措施的实施 识别系统与应用中的潜在漏洞，组织并监督渗透测试及安全评估 记录评估结果并确保风险被有效降低或消除 识别威胁并设计相应安全防护措施，评估其有效性 3. 安全运营与事件管理 协调信息安全事件处理，参与事件响应，包括缓解和修复措施制定 维护灾难恢复（DR）及应用恢复计划的及时更新与有效性 协助业务部门进行信息分类管理 4. 安全意识与合规推动 开发并开展面向不同目标群体的安全意识培训及宣传活动 职责细分（Job Designation） 1. 安全政策与标准管理 制定、更新并维护信息安全政策、标准与流程 确保其符合相关法律、法规及合同要求，并被清晰传达和定期评审 2. 合规管理（Regulatory Compliance） 确保公司符合如 ISO 27001、NIST 等相关法律法规及行业标准 理解并落实各类合规要求的控制措施 3. 安全审计与评估 负责内部安全审计的规划与实施，评估控制措施有效性并识别改进空间 协调外部安全审计，确保公司能够有效应对审计要求 4. 风险管理与治理体系 识别、评估并管理组织范围内的信息安全风险 制定风险缓解策略，并持续监控控制措施有效性 参与建设信息安全治理体系 5. 合规报告 向管理层及监管机构输出安全与合规相关报告 跟踪关键安全指标，记录合规活动，并沟通风险与问题 6. 政策执行与监督 监督安全政策执行情况 调查安全违规行为并推动整改 7. 第三方/供应商安全管理 评估供应商及第三方服务商的安全能力 审查合同中的安全条款，开展安全评估并持续监控其合规性 8. 协作与沟通 与IT团队、开发团队及业务部门紧密协作 提供安全培训和意识提升支持 向管理层传达安全风险与改进建议

任职资格（Qualification） 专业能力 深入理解并具备以下领域经验： 信息安全（IT Security） 风险管理（Risk Management） 合规与安全标准（Compliance & Security Standards） 数据保护（Data Protection） 各类操作系统基础知识

具备以下技术领域认知： 云安全（Cloud Security） 网络安全（Network） Web技术 数据库 IT运维（ITIL） 教育背景 计算机科学或信息安全相关专业，本科及以上学历