Information Security Specialist

Information security is to protect the confidentiality, integrity and availability of computer system data from those with malicious intentions. In addition, it refers to the processes and methodologies which are designed and implemented to protect print, electronic, or any other form of confidential, private and sensitive information or data from unauthorised access, use, misuse, disclosure, destruction, modification, or disruption.
The core requirements for the job include the following:
Information Security Fundamentals:
Strong understanding of information security principles, frameworks (ISO 27001 NIST CSF, CIS Controls), and financial industry regulations (PCI DSS, SOX, GLBA, GDPR, etc. ).
Knowledge of data protection, risk management, identity and access management, and cloud security concepts.
Policy and Procedure Development:
Ability to draft, review, and maintain security policies, standards, processes, and guidelines.
Familiarity with policy governance lifecycles, version control, and executive-level communication.
Risk Management and Assessments:
Proficiency in risk assessment methodologies and tools.
Experience reviewing and documenting risk exceptions, control gaps, and mitigations.
Ability to translate technical risk findings into business impact language.
Awareness and Training Skills:
Security Awareness Program Development.
Experience designing awareness campaigns, training modules, and user engagement strategies.
Familiarity with adult learning principles and instructional design for eLearning.
Ability to create effective, engaging content for diverse audiences.
Phishing Simulation and Social Engineering Testing:
Hands-on experience running enterprise phishing simulations, analysing results, and coordinating remediation/training.
Understanding common social engineering threats and user behaviour metrics.
Communication and Stakeholder Management:
Strong Written and Verbal Communication (all candidates).
Ability to produce clear and concise presentations, reports, and security updates for executive and non-technical audiences.
Skilled at drafting policy documents and awareness materials.
Collaboration and Influence (all candidates):
Comfortable working with stakeholders across technology, risk, compliance, and business teams.
Capable of influencing behaviour and culture change relating to security.
Metrics, Reporting and Analytics:
Experience in defining and reporting security KPIs, KRIs, and programme metrics.
Strong data analysis, visualisation, and presentation skills (Excel, Power BI, Tableau, or equivalent).
Ability to track program effectiveness and recommend measurable improvements.
Consulting and Professional Skills:
Ability to operate independently while aligning with the strategic goals of the global governance programme.
Strong project management, organisational, and multitasking skills.
Demonstrated problem-solving and analytical thinking abilities.
Consultancy and advisory experience in large, complex organisations.
Technical and Tool Proficiency (Preferred):
GRC platforms (e. g., Archer).
Risk assessment frameworks and methodologies.
Education and Certifications (Preferred):
Bachelor's degree in information security, technology, risk management, or a related field.
Relevant certifications: CISM, CISSP, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent.
Security awareness-focused certifications are desirable (e. g., SACP - Security Awareness and Culture Professional).

Experience
5-9 yrs