Senior Information Security Officer

Key responsibilities
● Contribute to the management and maintenance of PCCW Global’s Information Security Management System (ISMS) in accordance with the ISO 7001 standard
● Develop and maintain information security policies, processes and procedures to support ISMS implementation and improvement
● Identify, assess, and monitor information security risks, threats and vulnerabilities.
● Gather and analyse risk data to produce risk reports
● Undertake information security risk assessments and maintain and update the Risk Register
● Undertake information security control assessments to ensure controls are effectively managing risks and meeting applicable compliance obligations
● Provide risk management guidance and support to other Information Security Officers as required
● Produce and present information security measurements and metrics
● Ensure that core ISMS documentation is accurate and updated in a timely manner, including the Risk Register, Information Asset Register, Statement of Applicability and Incidents, and Corrective Actions and Improvements Register
● Conduct compliance audits, including internal audits, across a range of information security controls that support the certification requirements of ISO 27001
● Facilitate and coordinate external compliance audits and ensure that audit findings are actioned as required

Core competencies, skills and experience
● At least 7 years’ experience working in information security, audit and risk management
● End-to-end ISMS implementation experience
● Familiarity with key frameworks, e.g., ISO 27001, PCI-DSS, NIST
● Industry certifications such as CISA, CISM, CISSP, CRISC are beneficial but not essential.
● Experience running workshops, demonstrations and training
● Proven ability to interact with technical and business stakeholders
● Breadth and depth of knowledge in a range of technologies, security concepts and best practices
● Highly developed communication and organisational skills
● Experience with networking, software development or cloud platforms will be highly regarded