Job Description

WTS Energy is seeking to hire IT Cyber Security Team Lead role one of its client who is a reputed Oil and Gas operator.

 

Job Purpose

• Dual reporting to the Information Technology (IT) Manager and Chief Information Security Officer (CISO), the successful candidate will assume a dual role. As a main responsibility, the IT Cyber Security Team Lead will lead and participate alongside the Cyber Security Engineers in the execution and delivery of all projects and assignments with a day-to-day focus on operations. In addition, they will be responsible for all aspects of business development and operations, to successfully expand the Cyber Security assignments portfolio, and ensure overall operational excellence.
• Responsible for the confidentiality, integrity, and availability of the Company’s information by identifying all Information Security risks, creating and maintaining enforceable policies and supporting processes, and overseeing the continued compliance with regulatory requirements International Organisation for Standardisation (ISO 27001), Information Security Regulation (ISR) and all Cyber Security related compliance frameworks like National Institute of Standards and Technology (NIST).

 

Responsibilities:

• Responsible to help define and ensure the effectiveness of the Information Security Management Systems.
• Coordinate the Cyber Security Engineer(s) in their projects and assignment work execution in accordance with the delivery schedule, contractual requirements, and critical path adhering to all policies and procedures.
• Participate in Information Security related internal and external audits.
• Define protocols and maturing of ‘playbooks’ for Operational response to cyber threats and events.
• Identify and communicate current and emerging security threats and design security architecture elements and controls to mitigate threats as they emerge. Drive the implementation of emerging threat intelligence (IOCs), updated rules, etc.).
• Work closely with the IT team and the business to ensure that Information Security is considered and involved in project planning and all data is classified according to their confidentialities and criticalities.
• Report analysis and work with IT team during security incidents. Participate in post-incident reporting and propose enhancement to the systems and IT infrastructure to close the security gaps. Coordinate periodic testing of information security-specific processes, such as incident response plans. Assess and manage security risks related with new projects and existing applications / systems.
• Track and maintain security risk remediation plans with relevant parties to achieve compliance with security requirements and mitigate identified risks to an acceptable level.
• Direct the ongoing, proactive risk assessment programme for all new and existing systems and remain familiar with the Company’s goals and business processes so effective controls can be put in place for those areas presenting the greatest Information Security risk.
• Ensure vulnerabilities are managed by directing periodic vulnerability scans.
• Develop Information Security Awareness training and education programmes.
• Peer review and quality control of deliverables produced by the Cyber team – to achieve technical compliancy and successful sign-off.
• Provide Cyber Security expertise for Industrial Control Systems.
• Manage supplier relationships and interfaces and advise suppliers on recommended actions relating to active projects.

Requirements

Educational Qualifications:

• Degree in Engineering / Computer Science / Information Security / Information Management Systems or related field. 
• Certified Information Systems Security Professional (CISSP) preferred.
• Information Security and /or Information Technology industry certification (ISO 27001 Lead Implementer or Lead Auditor) preferred.
• Prince II or PMP preferred.
• CompTIA Network+, Security+, SSCP, CISM, CISA or equivalent certifications held or working towards.

 

Experience Profile:

• 5 – 10+ year’s work experience in Information Security implementation, management, monitoring, and audit.
• Proven track-record of understanding security controls and working across the organisation to implement and validate controls.
• Experience in coordinating small teams of engineers in their delivery of work on projects and assignments.
• Experience in working in ICS, SCADA, and other Operational Technologies.
• Oil and Gas Industry experience is preferred.

 

Competencies/Skills/Others:

• Knowledge of NIST, IEC 62443 and ISO270001 cybersecurity frameworks and APTA cybersecurity consideration for oil and gas assets preferred.
• The candidate will possess in-depth experience in the IT/Networking field with most recent experience having come from any three of the following areas:
  • Penetration testing.
  • Application security.
  • Malware Reverse Engineering.
  • Threat Intelligence.
  • Security Architecture.
  • Industrial Control Systems Security.
  • Telecom and Network security.
  • System or Network administration in a complex multi-national network.
  • Working in a Security Operations Centre (SOC) or in a Computer Emergency Response Team (CERT/CIRT).
• Demonstrated ability to identify automation/orchestration opportunities and developing plan to implement automation.
• Ability to communicate effectively with all levels of staff, management, and clients both verbally and in writing.
• Strong understanding of latest security principles and protocols.
• Strong understanding of security operations technologies including SIEM, endpoint tools and network-based logs.