Senior Information Security Analyst

About the role

The Senior Information Security Analyst will lead the governance and execution of the Information Security Management System (ISMS) for both IT and OT environments. This role develops and maintains security policies, standards and procedures, ensures compliance with current and future regulations, and supports the organization’s overall security posture.

Key responsibilities

• Govern and execute the ISMS, creating policies, standards and procedures for corporate information security in IT and OT.
• Define and promote security policies, standards and procedures, raising awareness across the organization.
• Ensure effective IT controls meet current and future security compliance requirements.
• Conduct compliance and operational maturity assessments for information and operational technology environments.
• Develop reporting metrics, dashboards and evidence of compliance activities.
• Coordinate vendor risk assessments, due‑diligence reviews and security requirement definitions with IT stakeholders, project managers and business owners.
• Maintain third‑party assessment documentation and stay updated on emerging threats and best practices.
• Collaborate with cross‑functional teams, including AI and digital functions, to align security governance with new technologies.
• Perform additional security‑related tasks as assigned by the team lead.

Required profile

• Bachelor’s degree in information security, computer science, engineering or a related field.
• 10+ years of professional experience in information security, preferably within large ICT/ICS environments in the Energy sector (Oil & Gas).
• Professional certifications such as CISSP, CISM, CRISC, GIAC, ISO 27001, etc.
• Experience defining Governance, Risk and Compliance (GRC) processes and using industry‑standard GRC tools.
• Strong knowledge of relevant state laws, industry regulations and security standards.
• Excellent written, verbal and presentation communication skills.

Required skills

• NIST Cybersecurity Framework
• ISO 27001
• CISSP, CISM, CRISC, GIAC certifications
• Information Security Management System (ISMS)
• Governance, Risk & Compliance (GRC) tools
• Industrial Control Systems (ICS) and Information & Communication Technology (ICT) security
• Vendor risk assessment and due‑diligence processes