Chief Information Security Officer - CISO

Summary of functions:

• Information Security (IS) direction and advice

• Capability building and communication

• Information security (IS) management, assurance and oversight 

Information security direction and advice

• Draft the strategy for an optimized IS capability, in line with UNOPS operational model, project portfolio, risk appetite, IT strategy, applicable regulation and international good practice standards. Ensure development roadmap(s) are in line with the vision, strategy and approach.

• Build trust and partner with key stakeholders to establish a holistic and integrated approach for managing  IS risks to strategy and global portfolio delivery. 

• Define IS priorities and enables decisions on risk taking, transfer, mitigation and avoidance based on thresholds and trade-offs. 

• Setting, communicating and training related Policies and evaluating their effectiveness as well as driving their implementation. Establishing a clear situational view through Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).

• Facilitate a culture within the IS domain of openness and accountability, resulting in proactive risk escalation and effective mitigation with clear and embraced ownership allocation. Lead by example.

• Identify and advise on mechanisms for driving the culture of accountability and IS becoming part of UNOPS organizational DNA.

• As a substantive contributor to the UNOPS digitalization journey, ensure that IS is incorporated into the UNOPS digitalization agenda and system requirements “by design”. As part of this, establish continuous horizon scanning and control automation capabilities.

• Build business cases for IS investments and manage associated budgets.

Capability and Awareness building

• Establish a global (matrix) IS organization for a coordinated roadmap implementation. Build and manage an IS Operations Center (SOC) and 24/7 incident response capability. 

• Set up and manage a portfolio of service providers to enable a hybrid delivery model.

• Foster collaborative relationships and partner with relevant senior stakeholders in order to:

  • Support offices in assessing their IS capability and addressing gaps identified. 

  • Co-build organizational resilience capability cross-functionally, promoting a holistic approach across people, processes, and technology.

  • Empower Personnel to take ownership of their role in securing UNOPS. 

• Be an advocate for the benefits of a risk-based approach, mapping of organizational assets and proactive threat assessment. 

• Develop an IS integration model by designating, training and coordinating IS champions within the organization. 

• Prepare and update an annual awareness plan including IS induction training for new personnel.

• Ensure that sound governance is in place to continuously improve UNOPS IS posture and benchmark it against relevant peers. 

• Empower and train the organization on effective methods to take ownership over risk assessment, mitigation and continuity planning.

• Recognise exemplary IS behavior and make recommendations as appropriate to support addressing disciplinary action, for information and system security breaches.

Information security management, assurance and oversight 

• Work in collaboration with the regions and corporate functions in embedding IS into business development, contracting and delivery. Oversee and support associated due diligence and identify de-risking and business growth opportunities.

• Partner with relevant process owners to ensure embedding of IS requirements, appropriate management approaches and reporting mechanisms. Advice on corrective actions for non-compliance and monitor their implementation.

• Roll-out phased approach for application of international standards (e.g. ISO, NIST, COBIT).

• Act as lead expert on IS specific technology solutions and platforms including but not limited to Google Cloud Platform and ERP systems, and deploying dedicated IS solutions (e.g. SIEM/EDR/XDR, DLP, MDM, IAM). 

• Act as a business partner to IT leadership. Collaborate with Information Technology function in ensuring that secure system development protocols and competences are effectively in place..

• Provide advice on data classification, data privacy, data loss prevention, asset inventory, IS architecture, vulnerability management, patch management, incident and problem management related protocols, methods and tools.

• Build IS awareness initiatives (e.g. phishing campaigns) and communication plans working closely with the CRO, the leadership and UNOPS communications team. 

• Work with relevant stakeholders to strengthen the organizational capacity to detect and respond to cyber attacks (multi-vector across technology, process, human and physical), including developing metrics to track the effectiveness of defensive capabilities.

• Support reviewing, testing and improving business continuity and disaster recovery plans.

• Address potential “false sense of security” through control testing.

• Maintain ongoing intelligence on the cyber threat landscape. Advise leadership on associated risks to operations. Use scenario analysis, case studies, bow ties, and exposure quantification to articulate complex, technical themes in “business language”, enabling decision making.

• Define IS risk metrics that “tell stories” to which business leaders can relate, moving beyond compliance and audit focused to a risk-driven approach to IS.

• Implement robust governance mechanisms for monitoring IS practices, surfacing risks, reporting them, and monitoring progress in mitigating them. Ensure timely risk and incident escalation.

• Support independent assurance providers (e.g. Internal Audit & Investigations Group, United Nations Board of Auditors) verifying the effectiveness of the IS Management System.  

• Oversee IS related KPI achievement and closure of audit related actions.

• Provide status updates on open roadmap, audit, and regulatory items.