Information Security Lead Engineer

About the Role
The Cybersecurity Lead Engineer – Infrastructure & Network Security is responsible for maintaining optimal information security management within the Infrastructure & Network. This role involves implementing security controls to uphold a robust cybersecurity posture and supporting the management of IT Information Security.

Responsibilities

• Collaborate with Infrastructure, Network, and service operation teams to ensure the security of IT infrastructure, network, and service operations.
• Coordinate with vendors to conduct vulnerability assessments and penetration testing for infrastructure and network.
• Work alongside Cybersecurity Engineer – governance and risk management to uphold infrastructure & network security management policies/procedures and manage risks.
• Assist in developing, implementing, and managing overarching enterprise processes for information security and associated architecture standards, including ISO 27001, NIA, cybersecurity laws, privacy management laws, and Qatar 2022 cybersecurity requirements.
• Evaluate suspected security breaches and recommend corrective actions, including those involving outside vendors.
• Adhere to cybersecurity incident management and incident response plans.
• Participate in the planning and execution of security incident responses.
• Aid Risk Management, Internal Audit, and IT departments in developing criteria to assess compliance of new/existing applications and technology infrastructure against enterprise security standards.
• Review infrastructure and/or technology environments during development or acquisition to ensure compliance with corporate security policies and to assist in the integration process in relation to IT’s technological ecosystem.
• Assess information security KPIs in line with Information Security/privacy objectives and adjust these based on changes in security objectives.
• Maintain infrastructure and network to support organizational information security/privacy policies and keep these up to date according to evolving circumstances, best practices, and regulatory mandates.
• Conduct security assessments to ensure adequate security posture within the IT Environment.
• Enhance security operations center monitoring in response to emerging cybersecurity threats.
• Collaborate with the Head of Information Security to coordinate with MOI security shield and ensure continuity of connectivity with NCSOC.
• Work together with the Head of Information Security and MPTO team to maintain the Qatar 2022 implementations based on the agreed roadmap.
• Provide daily, weekly, and monthly reports to the Information Security Lead regarding changes, incidents, problems, service operations, and critical areas related to infrastructure & network.

Mandatory Actions

• Attend IT Security Team Meeting on a monthly basis.
• Validate the risk register on a monthly basis until IT environment is stable.
• Validate Information Security KPIs on a monthly, quarterly (for reporting), bi-annual, and annual basis.
• Manage compliance with NIA, Qatar 2022, NCSOC, Q-cert, ISO 27001:2013, Cyber Crime Law, Privacy Law, and other applicable laws and regulations pertaining to IT.

Qualifications
Required Qualifications:

• University Degree in Information Technology, with an MSc in Information Security/Cybersecurity from an accredited university is a plus.
• Certifications in information security such as CISM, CISA, CRISC, CISSP, CBCP, GIAC, ISO27001LA, CCNA-security, or MCSE-security.
• Offensive security certifications such as CEH and CHFI are a plus.

Preferred Experience:

• A minimum of 5-8 years of experience, with at least 5 years in a similar position or responsibility.

Skills, Knowledge and Expected Behaviors Against Values/Competencies
Technical Competencies:

• In-depth understanding and management experience of information security standards, processes, and risk management.
• Familiarity with departmental priorities, products, and strategies.
• Knowledge of the information security landscape.
• Ability to maintain the ISO27001:2013 certificate and other compliance requirements.
• Capacity to develop information security strategy and define/validate KPIs.
• Expertise in benchmarking and risk management.
• Proficient in designing and maintaining information security management policies and procedures.
• Knowledge of governmental and regulatory requirements.
• Experience managing a Security Operations Center (SOC).
• Proficiency in current security tools and solutions.
• Understanding of personal information privacy management.

ORGANIZATION Values:

• Act as One
• Over deliver on our promises
• Share what matters
• Always Challenge Assumptions
• Be pioneering