Information Security Specialist

Що робити

• Lead the ISMS implementation and ISO/IEC 27001 certification programme: policies, risk assessment, Statement of Applicability, corrective action register. Coordinate with our external implementation partner and certification body, and prepare the company for Stage 1 and Stage 2 audits
• Plan and conduct internal ISMS audits and management reviews, ensuring the process is independent and properly evidenced
• Own security due diligence: partner and customer security questionnaires, preparation and management of the data room, technical sessions with their auditors, and counterparty assessments in return
• Build third-party risk management from the ground up: supplier assessments, security requirements in contracts and onboarding, and a register of third parties with access to our systems and data
• Document and operationalise BCP/DR: RTO/RPO for critical services, recovery procedures, and a working exercise cycle