Consultant - Information Security

About the Role
The Consultant - Information Security will play a critical role in maintaining the information security management within the Infrastructure & Network domain. The role involves continuing to implement security controls to ensure an adequate cybersecurity posture within the environment while supporting the management of the IT Information Security Lead.

Responsibilities

• Work with Infrastructure, Network, and Service Operations teams to ensure the security of IT infrastructure, networks, and service operations.
• Coordinate with vendors and conduct vulnerability assessments and penetration testing for infrastructure and networks.
• Collaborate with the Cybersecurity Engineer – Governance and Risk Management to maintain security management policies, procedures, and risk management.
• Assist in developing, implementing, and managing enterprise infrastructure processes for information security and associated architecture standards, including ISO 27001, NIA, Cyber Security Law, Privacy Management Law, and Qatar 2022 Cyber Security Requirements.
• Evaluate suspected security breaches and recommend corrective actions, including incidents involving external vendors.
• Follow the cyber security incident management and incident response plan.
• Participate in security incident response planning and execution.
• Assist Risk Management, Internal Audit, and the IT department in developing criteria to assess compliance levels of new and existing applications/technology infrastructure against enterprise security standards.
• Review infrastructure and technology environments during the development/acquisition process to ensure compliance with corporate security policies and to assist in integration with existing technology.
• Evaluate information security KPIs based on Information Security/Privacy Objectives and review based on changes to security objectives.
• Maintain infrastructure and networks to support the organization’s information security/privacy policies and procedures, ensuring timely updates.
• Conduct security assessments to maintain adequate security posture.
• Improve Security Operations Center monitoring based on evolving cyber security threats.
• Coordinate with the MOI Security Shield and maintain NCSOC onboarding and continuity of connectivity.
• Collaborate with the MPTO team to maintain Qatar 2022 implementations based on agreed roadmap.
• Provide daily, weekly, and monthly reports related to infrastructure and network environment changes, incidents, and critical areas to the Information Security Lead.

Mandatory Actions

• Attend IT Security Team Meetings on a Monthly Basis.
• Validate Risk Register on a Monthly Basis until the IT environment is stable.
• Validate Information Security KPI on a Monthly, Quarterly (Reporting), Bi-Annual, and Annual basis.
• Manage Compliance for NIA, Qatar 2022, NCSOC, Q-CERT, ISO 27001:2013, Cyber Crime Law, Privacy Law, and other applicable laws and regulations.

Qualifications
Competencies
Technical Competencies:

• Deep understanding and management experience in Information Security standards, processes, and risk management.
• Knowledge of Department Priorities, Products, and Strategy.
• Familiarity with the information security landscape.
• Ability to maintain ISO 27001:2013 certification and other compliance requirements.
• Experience in developing information security strategy and defining/validating KPIs.
• Expertise in benchmarking and risk management.
• Proven ability to design and maintain Information Security Management Policies and procedures.
• Knowledge of government and regulatory requirements.
• Experience managing a Security Operations Center (SOC) and using current security tools and solutions.
• Competence in personal information privacy management.

Key Business Interactions
Internal

• SJC IT Information Security Lead
• IT Department team and heads
• IT Security Team
• Internal Auditors

External

• Vendors
• External Auditors
• Regulatory Bodies

Required Qualifications

• University Degree in Information Technology, with an MSc in Information Security/Cyber Security from a recognized university preferred.
• Certifications in Information Security such as CISM, CISA, CRISC, CISSP, CBCP, GIAC, ISO27001LA, CCNA Security, MCSE Security.
• Offensive security certifications (CEH, CHFI) are a plus.

Preferred Experience

• Minimum 5-8 years of experience, with at least 5 years in a similar role.