IT Security Governance Officer

About the role

The IT Security Governance Officer will lead the development and maintenance of information security policies, standards, and procedures aligned with government regulations. This role ensures that all IT security controls meet national cybersecurity standards and supports senior management with governance reporting.

Key responsibilities

• Develop, implement, and maintain government‑aligned information security policies, standards, and procedures.
• Ensure compliance with national cybersecurity regulations, data protection laws, and government directives.
• Align IT security governance with frameworks such as ISO 27001, NIST, COBIT, and other government cybersecurity standards.
• Conduct information security risk assessments and support risk treatment plans.
• Monitor compliance with security controls across government systems and entities.
• Coordinate internal and external audits, regulatory reviews, and compliance assessments.
• Track security risks, exceptions, and remediation actions.
• Support governance aspects of cybersecurity incidents, reporting, and post‑incident reviews.
• Review third‑party and vendor security compliance for government contracts.
• Enforce data classification, access control, and information handling policies.
• Support mandatory government cybersecurity awareness and training programs.
• Prepare governance reports, dashboards, and compliance submissions for senior management.
• Collaborate with legal, compliance, IT, and national cybersecurity authorities.

Required profile

• Bachelor’s degree in information security, IT, Computer Science, or a related field.
• 4–7 years of experience in information security governance, risk, or compliance, preferably in the public sector.
• High integrity and strong attention to confidentiality requirements.

Required skills

• Knowledge of ISO 27001, NIST, and COBIT frameworks.
• Familiarity with national cybersecurity policies and government data‑protection laws.
• Professional certifications such as CISM, CISSP, ISO 27001 Lead Implementer/Auditor, and CRISC.
• Experience with risk assessment, audit coordination, and compliance monitoring.
• Strong documentation, reporting, and policy‑writing abilities.