Head - Information Security - Adhesives Manufacturing

Responsibilities:

Establish Governance and Build Knowledge:

- Facilitate an information security governance structure through the implementation of a hierarchical governance program, including the formation of an information security steering committee or advisory board.

- Provide regular reporting on the current status of the information security program to enterprise risk teams, senior business leaders as part of a strategic enterprise risk management program, thus supporting business outcomes.

- Work with the stakeholders to ensure that information security requirements are included in contracts by liaising with vendor management and procurement organizations.

Lead the Organization:

- Lead the information security function across the company to ensure consistent and high-quality information security management in support of the business goals.

- Determine the information security approach and operating model in consultation with stakeholders and aligned with the risk management approach and compliance monitoring of nondigital risk areas.

- Manage the budget for the information security function, monitoring and reporting discrepancies.

Set the Strategy:

- Develop an information security vision and strategy that is aligned to organizational priorities and enables and facilitates the organization's business objectives, and ensure senior stakeholder buy-in and mandate.

- Develop, implement and monitor a strategic, comprehensive information security program to ensure appropriate levels of confidentiality, integrity, availability, safety, privacy and recovery of information assets owned, controlled or/and processed by the organization.

Develop the Frameworks:

- Develop and maintain a document framework of continuously up-to-date information security policies, standards and guidelines. Oversee the approval and publication of these information security policies and practices.

- Create a framework for roles and responsibilities with regard to information ownership, classification, accountability and protection of information assets.

- Facilitate a metrics and reporting framework to measure the efficiency and effectiveness of the program, facilitate appropriate resource allocation, and increase the maturity of the information security, and review it with stakeholders at the executive and board levels.

Build the Network and Communicate the Vision:

- Provide input for the IT section of the company's code of conduct.

- Build and nurture external networks consisting of industry peers, ecosystem partners, vendors and other relevant parties to address common trends, findings, incidents and cybersecurity risks.

- Liaise with external agencies, such as law enforcement and other advisory bodies, as necessary, to ensure that the organization maintains a strong security posture and is kept well-abreast of the relevant threats identified by these agencies.

Operate the Function:

- Create a risk-based process for the assessment and mitigation of any information security risk in your ecosystem consisting of supply chain partners, vendors, consumers and any other third parties.

- Ensure that security is embedded in the project delivery process by providing the appropriate information security policies, practices and guidelines.

- Manage and contain information security incidents and events to protect corporate IT assets, intellectual property, regulated data and the company's reputation.

- Monitor the external threat environment for emerging threats, and advise relevant stakeholders on the appropriate courses of action.

Requirements and Qualifications:

- Minimum of seven to 10 years of experience in a combination of risk management, information security and IT or OT jobs (at least five must be in a senior leadership role)

- Excellent written and verbal communication skills, interpersonal and collaborative skills, and the ability to communicate information security and risk-related concepts to technical and nontechnical audiences at various hierarchical levels, ranging from board members to technical specialists

- Sound knowledge of business management and a working knowledge of information security risk management and cybersecurity technologies

- Project management skills: financial/budget management, scheduling and resource management

- Degree in business administration or a technology-related field, or equivalent work- or education-related experience

- Professional security management certification is desirable, such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or other similar credentials.

- Knowledge of common information security management frameworks, such as ISO/IEC 27001, ITIL, COBIT as well as those from NIST, including 800-53 and Cybersecurity Framework

Areas of Operations:

- Information Security and Governance

- License Compliance

- Risk management

Vidushi Singh
HR Talent Advisor
Talent Socio Bizcon LLP