Senior Information Security Officer (Qatarization)

About the role

The Senior Information Security Officer establishes and maintains a corporate-wide information security management program that protects information assets and meets compliance and regulatory requirements. The role covers governance, risk and compliance, project advisory, operational support and relationship building, and is open to candidates who wish to contribute to Qatarization.

Key responsibilities

• Develop and maintain information security policies, standards and guidelines, and oversee their approval, training and dissemination.
• Create a risk-based vendor risk management process and run awareness training for employees, contractors and system users.
• Work with business units on IT risk assessment, define the risk assessment process and report regularly to risk teams, senior leaders and the board.
• Define data classification and data privacy processes for the bank and advise on IT projects, including technical controls.
• Manage outsourced security vendors, coordinate incident management, and maintain a knowledge base of advisories, alerts and regulations.
• Run day-to-day threat and vulnerability management, review audit trails and logs, and oversee security testing and remediation.
• Advise on the selection, installation and configuration of hardware, applications and software, and research new security tools.
• Keep the Information Security Steering Committee informed of new regulations, conduct gap analyses and liaise with compliance, audit, legal, HR and external agencies.

Required profile

• Bachelor's degree in IT, computer science or information/cyber security; a higher related degree is an advantage.
• At least one professional qualification: ISC2 CISSP, SANS GIAC, or ISACA CISA/CISM or higher.
• 5-7 years of relevant information security experience; banking sector experience preferred.
• Knowledge of the banking sector in Qatar and the region preferred.
• English and Arabic language required.

Required skills

• Frameworks: ISO 2700x, PCI DSS, ITIL, COBIT.
• Risk, business impact, control and vulnerability assessments, and GRC tools.
• Vulnerability scanning and penetration testing (Nessus, Nexpose, Qualys); white-box, black-box and code review testing.
• Security solutions: firewall, WAF, NAC, IPS, SIEM; phishing simulation tools such as PhishMe.
• Project management, budgeting, scheduling and resource management.