首席信息安全官（CISO）— 保险与投资
Chief Information Security Officer (CISO) — Insurance & Investments
职位概述
首席信息安全官（CISO）是负责保护组织的信息、技术基础设施、应用程序、数据和数字服务免受网络威胁和安全风险的高管。
在保险与投资领域，CISO 负责企业级网络安全、信息安全治理、网络风险管理、安全架构、事件响应、合规性、身份与访问管理、第三方安全以及业务连续性/网络韧性。
主要职责
制定并执行企业级网络安全和信息安全战略。
建立信息安全政策、标准、控制措施和治理框架。
领导全公司范围内的网络安全风险管理。
保护敏感的客户、财务、投资、保单持有人、员工和企业数据。
负责以下方面：
安全运营（SOC）
威胁检测与响应
事件响应
安全架构
漏洞管理
渗透测试
身份与访问管理
端点安全
网络安全
云安全
应用安全
数据安全
建立并管理网络安全事件响应和危机管理流程。
领导安全监控、威胁情报、漏洞评估和安全测试。
在云、本地、应用、API 和数字平台中开发网络安全控制措施。
实施并维护身份与访问管理（IAM）、特权访问、多因素认证（MFA）和最小权限控制。
监督第三方/供应商的网络安全风险和技术尽职调查。
确保安全要求嵌入到数字化转型和技术项目中。
领导安全意识、钓鱼邮件防范和员工网络安全培训。
确保符合适用的金融服务、隐私、网络安全和监管要求。
管理安全审计、风险评估、控制测试和整改计划。
制定并测试业务连续性、灾难恢复和网络韧性计划。
建立网络安全关键绩效指标（KPI）、关键风险指标（KRI）、仪表盘和高管报告。
管理网络安全预算、供应商、托管安全服务商和战略技术合作伙伴。
领导和培养信息安全和网络安全团队。
向首席执行官（CEO）、董事会、风险委员会、审计委员会和高级管理层提供网络安全风险建议。
确保网络安全风险融入组织的整体企业风险管理框架。
Insura
查看英文原文
Job Summary
The Chief Information Security Officer (CISO) is the executive responsible for protecting the organization's information, technology infrastructure, applications, data, and digital services from cyber threats and security risks.
Within Insurance & Investments, the CISO leads enterprise cybersecurity, information security governance, cyber risk management, security architecture, incident response, regulatory compliance, identity and access management, third-party security, and business continuity/cyber resilience.
Key Responsibilities
Develop and execute the enterprise cybersecurity and information security strategy.
Establish information security policies, standards, controls, and governance frameworks.
Lead enterprise-wide cybersecurity risk management.
Protect sensitive customer, financial, investment, policyholder, employee, and corporate data.
Oversee:
Security Operations (SOC)
Threat Detection & Response
Incident Response
Security Architecture
Vulnerability Management
Penetration Testing
Identity & Access Management
Endpoint Security
Network Security
Cloud Security
Application Security
Data Security
Establish and manage cyber incident response and crisis-management processes.
Lead security monitoring, threat intelligence, vulnerability assessment, and security testing.
Develop cybersecurity controls across cloud, on-premise, applications, APIs, and digital platforms.
Implement and maintain Identity & Access Management (IAM), privileged access, MFA, and least-privilege controls.
Oversee third-party/vendor cybersecurity risk and technology due diligence.
Ensure security requirements are embedded into digital transformation and technology projects.
Lead security awareness, phishing prevention, and employee cybersecurity training.
Ensure compliance with applicable financial-services, privacy, cybersecurity, and regulatory requirements.
Manage security audits, risk assessments, control testing, and remediation programs.
Develop and test Business Continuity, Disaster Recovery, and Cyber Resilience plans.
Establish cybersecurity KPIs, KRIs, dashboards, and executive reporting.
Manage cybersecurity budgets, vendors, managed security providers, and strategic technology partners.
Lead and develop information-security and cybersecurity teams.
Advise the CEO, Board, Risk Committee, Audit Committee, and senior leadership on cyber risk.
Ensure cybersecurity risks are integrated into the organization's overall enterprise risk-management framework.
Insurance & Investments Security Focus
Particularly relevant experience includes protecting:
Insurance
Policyholder/customer data
Claims systems
Underwriting platforms
Actuarial systems
Payment systems
Customer portals
Insurance APIs
Fraud and identity data
Investments / Asset Management
Portfolio and investment systems
Trading platforms
Market and financial data
Investment research
Client/investor information
Custody and transaction systems
Wealth-management platforms
Third-party investment technology
Ideal Candidate Profile
15+ years of IT, cybersecurity, information security, technology risk, or related experience.
7+ years in senior cybersecurity/security leadership.
Previous experience as:
CISO
Group CISO
Chief Information Security Officer
Chief Cybersecurity Officer
Head of Information Security
Head of Cybersecurity
Director of Information Security
Director of Cybersecurity
VP Information Security
VP Cybersecurity
Strong background in Insurance, Banking, Investment Management, Asset Management, Wealth Management, or Financial Services.
Strong expertise in:
Cybersecurity strategy
Information security governance
Cyber risk management
Security architecture
SOC/SIEM
Incident response
Threat intelligence
Vulnerability management
IAM/PAM
Cloud security
Application security
Network security
Data security
Third-party risk
Business continuity/cyber resilience
Experience with recognized security frameworks and standards such as NIST, ISO 27001, CIS Controls, COBIT, or equivalent.
Strong understanding of financial-services cybersecurity and regulatory requirements.
Demonstrated experience presenting cyber risk to Board/C-suite stakeholders.
Strong leadership, crisis management, risk communication, and stakeholder-management skills.
Relevant bachelor's degree; Master's degree and certifications such as CISSP, CISM, CRISC, CISA, CCSP or equivalent are advantageous.
Originally posted on Himalayas