Manager- ICS Risk Assessment

Purpose and Scope:
The job holder is responsible for ensuring the implementation and completion of related administrative tasks related to information and Cyber security management framework. He/she will work closely with management to understand business requirements to ensure identification of Cyber Security related threats and vulnerabilities and alignment, implementation, and maintenance of controls according to risk profiles.
Job Roles & Responsibilities
Strategy, Planning and Management
Planning and Management
Contribute to the design of Information and Cyber Security Strategy and policy identifying necessary control areas for IT processes and procedures to meet the Bank's business objectives.
Develop and enhance Cyber policies, InfoSec/Cyber procedures, controls and standards for data security of the bank.
Manage and promote Cyber Security to ensure that the project understands the value of best practice and supports the defined Cyber Security objectives
Identify, analyse, treat, and ensure timely communication of Cyber Security related threats and vulnerabilities through management of the Cyber Security risk analysis process.
Identify and assess potential risks to the bank sensitive information, including personally identified information (PII), and confidential information.
Define the Cyber Security requirements for the identified project and assist with the creation of operational processes, ensuring alignment to EBRD standards and industry best practice recommendations
Operations, Review and Reporting
Understanding
Maintain updated knowledge of cyber rules, regulations and standards in the concerned field and related matters of interest to the department.
Fieldwork
Ensure that an appropriate level of Information and Cyber Security controls is applied to every project.
Ensure that projects deliver solutions that are fit for purpose from IT Security stand point and any deviations/risks are raised as appropriate.
Perform formal Risk Assessments where exceptions to bank security policies are required and register the findings in the Bank's risk register Scope of Services Work within a project team with a focus on embedding relevant security controls into the project delivery process
Establish, implement and maintain a suite of Information ad Cyber controls within the scope of the project, protecting IT systems and providing visibility of potential threats and vulnerabilities.
Development of clear and concise reporting suitable for presentation to Project Management including submission of regular Key Risk Indicator reports highlighting Cyber Security activities as required by the project. Ensure key Cyber Security project deliverables are addressed within agreed timescales.
Ensure secure working best practices are embedded within the environment, and that the appropriate alerts are recorded within the relevant SIEM tools.
Facilitate and manage appropriate vulnerability assessments and manage the remediation activity as related to the project.
Provide expertise in the definition, selection and implementation of Cyber Security related controls to the Information and Cyber Security Department.
Review and Monitoring
Regularly review and update risk assessments (Comprehensive and thorough, Accurate and up-to-date, Relevant to the Bank's assets, systems, and data).
Monitor risk mitigation efforts and progress (Effective in reducing the likelihood or impact of identified risks, implemented in a timely and consistent manner, continuously monitored and improved).
Reporting
Generate and escalate periodic and ad hoc reports ensuring accuracy and timely delivery
Stakeholder Management
Internal Interactions
Participate in various cross-functional committees/teams for purposes like: executive team discussions, audits, etc. to achieve optimal cooperation and quality service
Work closely with members of Operation Risk and Information Security to ensure any Cyber Security controls and associated risks are appropriately managed in delivery of the project.
Manage the security awareness process and provide Information Security related training for all Business and IT Staff, DBA and tech support and card related security training for card operations
Manage the PCI DSS, Swift CSP, ISMS, InfoSec and the related sub-projects by coordination with staff in IT Department, Card operations and retail management
Participate in workshops, providing security guidance and recommendations to help structure requirements and shape project deliverables
Act as the key Cyber Security technical point of contact for the project and engage with internal teams to ensure all interests and objectives are included.
External Interactions
Perform vendor management including vendor selection, proposal negotiations, procurement of products, managing the vendor support etc.
Work with third parties to establish and implement the baseline for Cyber Security controls Ensuring that LOD2, assurance over IT & Information Security control implementation can be provided.
People Development
Participate in the selection and development of staff
Evaluate performance and recommend developmental needs of the team
Review recommendations of subordinate staff and provide guidance in resolving complex or sensitive problems
Maintain and promote positive work culture and responsible for improving employee engagement level of the team
Job Specifications:
Educational Qualification(s):

Bachelor's degree or equivalent in a related field
Certification(s):
Domain/experience in financial sector, with Technical and Governance scope
Technical certifications - ECSA, CEH, CHFI, SANS
Cyber and Data security Governance programs - Swift PCI, CISA, CISSP, CISM, CRISC, COBIT, ISO 27001 standards
Experience:

Minimum 9 years of experience
Language(s) known:

English (Proficient) and Arabic (Proficient).
•