Senior Consultant, IT Security (ISO/IEC 2700)

Overview

The Senior IT Security Consultant for Certification will be a part of service delivery team in Managed Security Services, working together with other teams to provide IT security audits, IT security assessments, ISMS framework management support, IT security certification related consultancy as well as ISMS implementation project management.

Duties & Responsibilities

• Provide consultancy in security implementation, which includes (though not limited to) performing gap analysis, risk assessment, establish security documentation and security measurements, conduct security awareness training, conduct management review meetings, and provide audit assistance in external audits during implementation phase.
• Manage security implementation project by working seamlessly with project team and implementation vendor, liaising and managing supporting teams, conduct security implementation meetings for progress updates and participate in security audits.
• Manage the ISMS Framework, which includes (though not limited to) performing document review, conducting management review meeting, managing the ISMS risk management and monitoring the ISMS activities to ensure effectiveness
• Lead and/or conduct IT security independent audits, based on customer’s requirements which can be international standards (ISO 27001, ISO 20000 chapter 6.6, PCI DSS), local standard (MTCS SS584), or process compliance (IT general controls; customers’ policies and processes)
• Manage the ITSM ISO 20000 Security Risk Management
• Manage and maintain the ISO 27001 mandatory documents
• Ad-hoc: Perform one-time IT security assessment; Conduct ad-hoc security awareness briefing; Manage non-ISO security risk exercises; Take on the role of audit guide or observer during external audits

Key Requirements

• Diploma or higher in Computer Science, Engineering and Information Systems
• Problem-solving skill with common sense to overcome technical limitations
• Customer-focused with good interpersonal skills
• Team player and also able to work independently
• Highly proficient in the areas of;
  • ISO/IEC 27001 security clauses and controls
  • IT security risk management
  • IT security framework and compliance
  • IT security assessments and audits
• At least 5 years of experience in Cyber Security

• Good understanding in ISO/IEC 27001:2013 and ISO/IEC 20000:2011
• Must possess valid ISO/IEC 27001:2013 Lead Auditor certificate
• One or more certification from the list below:
  • ITIL, CISM, CISA