Chief Information Security Officer

Job Description:

Functional:

·       Develop and implement the DCAA's information security strategy in alignment with business goals and objectives. Ensure that security initiatives support the overall strategic direction of DCAA.

·       Establish and maintain comprehensive information security policies and procedures that comply with industry standards, regulations, and legal requirements (e.g., ISO 27001, ISR and other DESC standards). Ensure these policies are effectively communicated across DCAA. Oversee periodic audits and assessments to ensure compliance.

·       Identify, assess, and prioritize information security risks. Develop and implement risk management strategies to address and mitigate these risks effectively, including business continuity and disaster recovery planning.

·       Guide the design and implementation of security architecture and frameworks that safeguard the DCAA’s information systems and data. Ensure these architectures are robust, scalable, and adaptable to emerging threats.

·       Lead the development and execution of incident response plans. Manage the response to major security incidents, including coordination with external parties, forensic analysis, and post-incident reviews.

·       Collaborate with IT, Strategy, Legal, and other key departments to integrate security practices into business processes. Serve as the primary liaison between the information security team and other business units.

·       Develop and implement organization-wide security training programs. Promote a culture of security awareness by educating employees about security policies, best practices, and emerging threats.

·       Oversee the implementation of continuous monitoring systems to assess and report on the DCAA’s security posture. Provide regular updates to executive management (DG), the directors and business unit heads, and other key stakeholders on security metrics and incident status.

·       Stay informed about the latest trends, threats, and technologies in the information security field. Drive innovation in security practices and technologies to continuously improve DCAA’s security posture.

·       Evaluate and manage the security risks associated with third-party vendors and partners. Ensure that third-party services meet security standards and contractual obligations.

·       Ensure the efficient allocation of resources to support security initiatives and projects. Ensure that security investments align with organizational priorities and deliver value.

·       Establish security governance committees or working groups. Facilitate the review of security policies, risk assessments, and incident reports at a senior level. Contribute to the development of long-term security strategies.

·       Act as the primary point of contact for regulatory agencies and external auditors regarding information security matters. Ensure timely and accurate responses to regulatory inquiries and audits.

·       Participate in organizational crisis management planning and execution. Provide expert advice during security-related crises and high-impact incidents.

·       Develop and track key performance indicators (KPIs) and metrics to measure the effectiveness of security programs and initiatives. Use this data to drive continuous improvement. Ensure to report the periodic progress to management and support in taking business decisions.

·       Ensure that all information security practices adhere to ethical standards and legal requirements. Promote a culture of integrity and accountability within the information security function.

·       Ensure compliance with non-disclosure and confidentiality agreements, as well as DCAA security policies, to safeguard both government and DCAA confidential information. Address and rectify any ISR audit findings, promptly report security incidents, and engage in ongoing security awareness training to prevent unauthorized access or disclosure.

·       Other duties: Perform other job-related duties as may be assigned from time to time by the Head of HR Policies and Development Section.

Managerial:

·       Allocates/coordinates work within the team/project and/or contributes to technical/professional direction for a discipline.

Job Requirements:

·       Bachelor’s degree

·       Certified Information Systems Security Professional by ISC2 (CISSP)

·       Certified Information Security Manager (CISM)

·       Certified in Risk and Information Systems Controls (CRISC)

·       Certified Chief Information Security Officer by EC-Council

·       ISO 27001:2022 Lead Auditor and Lead Implementer

·       GIAC Security Essentials (GSEC)

·       At least (8-10) years of working experience.