INFORMATION SECURITY PROGRAM MANAGEMENT OFFICER

This role is responsible for assisting the Enterprise Information Security Officer in the implementation of the information security program to ensure the attainment of information security and business objectives and to align initiatives to overall business and risk management strategies.

Responsibilities

1 Information security policies, standards and guidelines development – ensures the appropriate use and protection of information assets through the following:

• Identifies bank-level information security requirements of all stakeholders (internal and external)
• Identifies gaps between the bank’s information security policies, standards and guidelines and the information security requirements
• Develops or maintains the bank’s information security policies, standards and guidelines, and other action plans that address the information security requirements
• Reviews unit-level policies and standards to ensure alignment with the bank-level information security policies and standards
  
  

2 Information security risk assessment – facilitates the assessment of information security risks through the following:

• Provides the methodology and tools to facilitate the development and maintenance of information asset profiles and risk assessments
• Coordinates the bank-wide conduct of information asset profiling and risk assessment activities with business risk officers, information owners and information custodians
• Reviews information asset profiles and risk assessments to ensure the appropriateness of the risk mitigation strategy
• Establishes and maintains an information asset and information security risks registry
  
  

3 Security awareness – promotes information security awareness through the following:

• Manages the review and updating of the security awareness program in coordination with other units (e.g. Human Resources, Information Systems Group, etc.)
• Proposes or implements continuous activities to improve security awareness
  
  

4 Incident Management – Assists The Enterprise Information Security Officer In Performing His Functions As Incident Management Team (IMT) Lead And Computer Security Incident Response Team (CSIRT) Incident Officer, Which Includes The Following

• Assesses reported incidents
• Activates the incident handling team
  
  

5 Outsourced services vendor management – ensures vendor compliance with information security requirements through the following:

• Conducts vendor information security management assessment according to the outsourcing policy
• Performs due diligence checks on vendors
• Establishes and maintains a vendor registry to track information security requirements related to outsourced services
  
  

Information Security Strategic Plan And Program Management

• Assists in the development, maintenance and implementation of the information security strategic plan and information security program
• Designs and conducts assessment tests, or implements metrics, to measure the effectiveness of the information security program
• Facilitates the consolidation and preparation of reports on the information security risk profile of the enterprise, and the effectiveness of the information security program, to be submitted to the Board of Directors and Senior Management
• Provides consultancy services on the information security aspects of new processes and technologies, and alignment to information security-related banking regulations