Head of Information Security & Enterprise Risk Management
职责目的信息安全与企业风险管理负责人是设计，管理和持续加强整个企业的网络安全，信息风险和技术风险框架。该角色需要深入专业化在先进的网络安全架构，全球监管合规和大规模风险治理方面。关键责任 1.企业信息安全领导 · 设计和拥有符合全球标准 (ISO,NIST,COBIT) 和不断发展的威胁景观的全企业信息保护战略 · 建立和管理本地，云，混合物联网，OT 和 IoT 环境中的安全架构 · 作为网络风险接受，升级和缓解的最终权威者 2. 网络风险与威胁管理 · 领导先进的网络威胁情报，攻击模拟和事件响应计划 ·监督安全运营中心 (SOC) 模型，包括 SIEM,SOAR,威胁猎杀和法医调查 · 对重大网络事故，勒索软件事件或数据泄露的危机反应 3. 企业风险管理 （技术和数字风险）· 将技术风险，网络风险，数据风险和第三方风险整合到更广泛的 ERM 框架中 · 进行量化网络风险评估 （例如，FAIR 方法）· 向董事会和执行委员会提出风险场景和财务影响建模 4.监管，合规与治理 ·确保遵守包括：GDPR,ISO 27001/27701在内的全球和国际法规的遵守 · NIST CSF,PCI-DSS ·行业特定的网络法规 （金融，基础设施，公用品，房地产等）·负责信息安全和技术风险相关的内部和外部审计 ·作为网络和风险问题的主要监管和审核对手 5.第三方 IT &供应链风险 · 建立供应商网络风险，云服务提供商，MSP 和离岸合作伙伴的治理 ·监督尽职调查，合同安全条款和持续监控计划 6.领导力与能力建设 ·构建和指导高度专业的安全和风险团队 （安全建筑师，GRC 专家，SOC 分析师）·开发长期的网络能力提升方案 ·担任首席执行官，董事会和集团高管的可靠顾问
查看英文原文
Role Purpose
The Head of Information Security & Enterprise Risk Management is a senior executive responsible for designing, governing, and continuously strengthening an enterprise-wide cyber security, information risk, and technology risk framework across a complex, multi-business, multi-technology environment.
This role requires deep specialization in advanced cyber security architecture, global regulatory compliance, and large-scale risk governance.
Key Responsibilities
1. Enterprise Information Security Leadership
- Design and own the enterprise-wide information security strategy, aligned with global standards (ISO, NIST, COBIT) and evolving threat landscapes
- Establish and govern security architecture across on-premise, cloud, hybrid, OT, and IoT environments
- Act as the final authority on cyber risk acceptance, escalation, and mitigation
2. Cyber Risk & Threat Management
- Lead advanced cyber threat intelligence, attack simulation, and incident response programs
- Oversee Security Operations Center (SOC) models, including SIEM, SOAR, threat hunting, and forensic investigations
- Lead crisis response for major cyber incidents, ransomware events, or data breaches
3. Enterprise Risk Management (Technology & Digital Risk)
- Integrate technology risk, cyber risk, data risk, and third-party risk into the broader ERM framework
- Conduct quantitative cyber risk assessments (e.g., FAIR methodology)
- Present risk scenarios and financial impact modeling to the Board and Executive Committee
4. Regulatory, Compliance & Governance
- Ensure compliance with global and cross-border regulations, including:
- GDPR, ISO 27001/27701
- NIST CSF, PCI-DSS
- Industry-specific cyber regulations (financial, infrastructure, utilities, real estate, etc.)
- Lead internal and external audits related to information security and technology risk
- Serve as the primary regulatory and auditor counterpart for cyber and IT risk matters
5. Third-Party & Supply Chain Risk
- Establish governance for vendor cyber risk, cloud service providers, MSPs, and offshore partners
- Oversee due diligence, contract security clauses, and continuous monitoring programs
6. Leadership & Capability Building
- Build and mentor a highly specialized security and risk team (security architects, GRC experts, SOC analysts)
- Develop long-term cyber capability uplift programs
- Serve as trusted advisor to CEO, Board, and Group Executives
Required Qualifications (Highly Specialized)
Education
- Bachelors Degree in Computer Science, Cybersecurity, Information Systems, or Engineering
- Masters Degree in Cybersecurity, Information Assurance, Risk Management, or related field (strongly preferred)
Mandatory Global Certifications
Candidates must possess multiple of the following:
- CISSP (Certified Information Systems Security Professional)
- CISM (Certified Information Security Manager)
- CISA (Certified Information Systems Auditor)
- CRISC (Certified in Risk and Information Systems Control)
- ISO 27001 Lead Implementer / Lead Auditor
- Cloud Security Certifications (CCSP, AWS/Azure Security Specializations)
Experience Requirements
- 15+ years of progressive experience in:
- Information Security
- Cyber Risk Management
- Enterprise Technology Risk
- Minimum 7–10 years in a regional or global leadership role
- Proven leadership across large, complex organizations (multi-entity, multi-system, multi-jurisdiction)
The role requires hands-on experience in:
- Designing enterprise-scale cyber security programs across:· Cloud, on-premise, hybrid, OT, and legacy systems
- Leading major cyber incident response at enterprise or regional level
- Implementing global security frameworks across multiple countries
- Presenting cyber risk in financial and strategic terms to Boards
- Managing cross-border data privacy and regulatory compliance
Behavioral & Leadership Competencies
- Board-level gravitas and executive presence
- Ability to translate deep technical risk into business language
- Strong crisis leadership and decision-making under pressure
- Proven mentor and builder of local capability
Originally posted on Himalayas