信息安全部主管 — 保险与投资
Head of Information Security — Insurance & Investments
职位概述
信息安全负责人领导组织的信息安全职能，保护技术系统、应用程序、网络、数据和数字服务免受网络威胁和运营安全风险。
在保险与投资领域，该职位重点在于信息安全治理、网络风险、安全运营、身份与访问管理、漏洞管理、事件响应、第三方安全、云/应用安全以及监管合规。
主要职责
制定并实施信息安全战略、路线图、政策和标准。
建立并维护组织的信息安全治理框架。
开展全公司的网络安全和信息安全风险评估。
领导安全运营、监控、威胁检测和事件响应。
负责以下方面：
安全运营中心（SOC）
SIEM
威胁情报
漏洞管理
渗透测试
身份与访问管理（IAM）
特权访问管理（PAM）
网络安全
终端安全
云安全
应用安全
数据安全
制定和维护信息安全政策、流程、控制措施和标准。
管理安全事件、调查、遏制、修复和事件后评审。
建立漏洞管理和安全测试计划。
确保适当的访问控制、认证、多因素认证、职责分离和最小权限实践。
保护敏感的客户、保单持有人、财务、投资、员工和企业数据。
与IT和技术团队合作，将安全嵌入基础设施、应用程序、云、API和数字化转型项目中。
对新系统、应用程序、供应商和技术实施进行安全审查。
管理第三方/供应商的网络安全风险和安全尽职调查。
支持业务连续性、灾难恢复和网络韧性计划。
领导安全意识、员工培训、钓鱼模拟和网络安全文化举措。
确保符合适用的金融服务、隐私、网络安全和监管要求。
协调内部/外部安全审计和整改活动。
制定安全KPI、KRIs、仪表盘和管理报告。
管理安全供应商、托管安全服务商、预算和技术投资。
领导、指导和发展信息安全和网络安全团队。
提供报告
查看英文原文
Job Summary
The Head of Information Security leads the organization's information-security function, protecting technology systems, applications, networks, data, and digital services against cyber threats and operational security risks.
Within Insurance & Investments, the role focuses on information-security governance, cyber risk, security operations, identity and access management, vulnerability management, incident response, third-party security, cloud/application security, and regulatory compliance.
Key Responsibilities
Develop and implement the Information Security strategy, roadmap, policies, and standards.
Establish and maintain the organization's information-security governance framework.
Conduct enterprise-wide cybersecurity and information-security risk assessments.
Lead security operations, monitoring, threat detection, and incident response.
Oversee:
Security Operations Center (SOC)
SIEM
Threat Intelligence
Vulnerability Management
Penetration Testing
Identity & Access Management (IAM)
Privileged Access Management (PAM)
Network Security
Endpoint Security
Cloud Security
Application Security
Data Security
Develop and maintain information-security policies, procedures, controls, and standards.
Manage security incidents, investigations, containment, remediation, and post-incident reviews.
Establish vulnerability-management and security-testing programs.
Ensure appropriate access controls, authentication, MFA, segregation of duties, and least-privilege practices.
Protect sensitive customer, policyholder, financial, investment, employee, and corporate data.
Partner with IT and technology teams to embed security into infrastructure, applications, cloud, APIs, and digital transformation projects.
Conduct security reviews of new systems, applications, vendors, and technology implementations.
Manage third-party/vendor cybersecurity risk and security due diligence.
Support business continuity, disaster recovery, and cyber-resilience programs.
Lead security awareness, employee training, phishing simulations, and cybersecurity culture initiatives.
Ensure compliance with applicable financial-services, privacy, cybersecurity, and regulatory requirements.
Coordinate internal/external security audits and remediation activities.
Develop security KPIs, KRIs, dashboards, and management reports.
Manage security vendors, managed security providers, budgets, and technology investments.
Lead, mentor, and develop information-security and cybersecurity teams.
Provide regular security-risk reporting to the CISO, CIO, executive management, Risk Committee, or Board, depending on organizational structure.
Insurance & Investments Security Focus
Insurance
Policyholder and customer information
Claims and underwriting systems
Insurance applications and portals
Payment systems
Customer identity and authentication
Actuarial and risk systems
Fraud-management platforms
Third-party insurance technology
Investments / Asset Management
Portfolio-management systems
Trading and investment platforms
Market and financial data
Investment research systems
Client/investor information
Custody and transaction systems
Wealth-management platforms
Investment APIs and third-party providers
Ideal Candidate Profile
10–15+ years of information security, cybersecurity, IT risk, or technology experience.
5+ years in information-security leadership.
Previous experience as:
Head of Information Security
Head of Cybersecurity
Head of Cyber Security
Head of IT Security
Director of Information Security
Director of Cybersecurity
Information Security Director
Cybersecurity Director
VP Information Security
Information Security Manager
Senior Information Security Manager
Experience in Insurance, Banking, Investment Management, Asset Management, Wealth Management, or Financial Services preferred.
Strong knowledge of:
Information-security governance
Cyber risk management
Security operations
Incident response
Vulnerability management
IAM/PAM
Cloud security
Application security
Network security
Data security
Security architecture
Third-party risk
Business continuity/cyber resilience
Familiarity with NIST, ISO 27001, CIS Controls, COBIT, or equivalent frameworks.
Experience managing security teams and external security vendors.
Strong understanding of financial-services security and regulatory requirements.
Strong communication skills with IT, Risk, Compliance, Audit, Legal, and executive stakeholders.
Certifications such as CISSP, CISM, CISA, CRISC, CCSP are advantageous.
Originally posted on Himalayas