Business Information Security Officer

Job Description: 

The Regional BISO MEI - 

• Collaborates with stakeholders to address and identify high-risk areas and  support business-critical projects and key initiatives. 
• Works with Project Managers, Business Analysts, architecture, compliance, and  support team to ensure Fugro Information Security standards are being followed. 
• Responsible for information security posture and assurance for MEI, and where  applicable Global. 
• Influences to achieve positive change to the Information Security posture  through regular engagement and collaboration. 
• Actively shares knowledge and insights to increase Information Security  awareness throughout the region. 
• Collaborates with the Security Operations Center and to respond to and manage  priority incidents. 
• Actively works with the Security Operating Center to remediate regional  vulnerabilities and develop possible use cases. 

Key result area 

Information Security advisor with a regional scope covering both governance and  operational aspects.   

Major Security Incidents 

• Coordinates major information security incident management, in the region, in  collaboration with the various IT teams and the Security Operations Centre. 

Adopt Information Security best practises 

• Act as an advisor and provide consistent interpretation of Information Security  policies, standards and procedures to stakeholders. 
• Review adherence to Information Security policies while continuously  monitoring and reporting on risks. 

Risk Management & Data Sovereignty 

• Oversees Information Security posture in the region and provides actionable  plans to reduce risk levels. 
• Will understand key (information) assets and processes, identify and evaluate  risks and Information Security controls, and suggest risk management  approaches where necessary. 
• Provide Information Security advice for business-critical projects. 
• Responsible for the business continuity process for MEI 
• The individual will assess suppliers on Information Security maturity. 
• Responsible for data sovereignty in the region, engage and collaborate with the  geo-processing team to maintain sovereignty in the region. 

Support compliance efforts 

• Address client Information Security requirements. Furthermore, together with  the Information Security team develop a ‘toolkit’ to address common client  requests.
• Ensure Information Asset Owners implement the right measures to make the  regional IT landscape compliant and secure. For instance, adhere to GDPR and  client requirements data sovereignty requirement for Middle east & India. 
• Discuss compliance and audit findings with management and develop action  plans to address them. Will drive remediation activities across the region. 

Drive Information Security awareness 

• Drive education and increase Information Security awareness. 
• Share relevant risk analyses and Information Security metrics with the business  line. 

Others experience 

Functional 

• Demonstrated experience in Information Security (e.g. Security Operations and /  or Information Risk & Security Governance); 
• Understanding of common security risk scenarios, threats, and vulnerabilities; 
• Knowledge on Information Security standards, such as ISO 27001 and NIST. Leadership 
• Good stakeholder engagement skills and a healthy degree of business acumen  and interest; 
• Proven ability to collaborate across functions;
• Process-driven, has attention to detail and is well organized; 
• Takes ownership and is not afraid to fail. 

Good to have 

• ISO27001 implementation, operation and management, security control audits  and assessments; 
• Understanding of relevant legal & compliance aspects, such as GDPR. 
• Experience on working with external and internal auditors 

Skills and Qualifications: 

• Bachelor or Masters Information Security, Information Technology or relevant  professional experience. 
• 5-10 years of experience. Ideal candidates would have work experience in both  Security Operations and Governance, Risk and Compliance.
• Relevant Information Security certifications are seen as a plus, but not required.