information security manager

Key Responsibilities

• Develop, implement, and manage the organization's information security strategy, policies, and procedures .
  
  
• Lead the design and enforcement of security controls to protect systems, networks, and data from cyber threats.
  
  
• Manage a team of security professionals, providing technical guidance, mentoring, and performance management .
  
  
• Oversee risk assessments, vulnerability management, penetration testing, and incident response .
  
  
• Ensure compliance with regulatory requirements, industry standards, and frameworks (e.g., ISO 27001, NIST, GDPR, PCI-DSS, HIPAA).
  
  
• Collaborate with IT, DevOps, and business teams to embed security into application development and infrastructure design .
  
  
• Manage security operations center (SOC) activities , including monitoring, threat detection, and escalation.
  
  
• Define, track, and report security KPIs and risk metrics to senior leadership.
  
  
• Evaluate, select, and implement security tools and technologies to strengthen organizational defenses.
  
  
• Lead security awareness and training programs to promote a strong security culture .
  
  

Required Technical Skills (Tough Skills)

• Cybersecurity & Risk Management : Strong knowledge of threat modeling, risk assessment methodologies, incident response frameworks , and business continuity planning .
  
  
• Security Technologies : Hands-on expertise with firewalls, IDS/IPS, SIEM (Splunk, QRadar, ELK), EDR/XDR, DLP, IAM, PAM solutions, WAF, and CASB .
  
  
• Cloud Security : Proficiency in securing workloads on AWS, Azure, and GCP , including IAM, KMS, Cloud Security Posture Management (CSPM) .
  
  
• Application & Network Security : Experience in secure SDLC, DevSecOps practices, vulnerability management, penetration testing tools (Burp Suite, Metasploit, Nessus, Qualys) .
  
  
• Cryptography & Data Protection : Understanding of PKI, SSL/TLS, encryption protocols, key management, tokenization, and data masking .
  
  
• Governance, Risk & Compliance (GRC) : Familiarity with ISO 27001, SOC 2, NIST CSF, COBIT, GDPR, HIPAA, PCI-DSS frameworks.
  
  
• Incident Response & Forensics : Ability to manage SIEM alerts, digital forensics, malware analysis , and lead response teams during breaches.
  
  
• Scripting & Automation : Knowledge of Python, PowerShell, or Bash for automating security operations and log analysis.
  
  

Good to Have

• Security certifications such as CISSP, CISM, CISA, CEH, OSCP, CCSP, ISO 27001 Lead Implementer/Auditor .
  
  
• Experience in Zero Trust Architecture and container security (Docker, Kubernetes) .
  
  
• Knowledge of threat intelligence platforms and SOC automation (SOAR) .