Chief Information Security Officer - CISO

• Bring in proven expertise in implementing effective information security strategies and solutions fit to an industry, operating model, organizational culture and inherent risks within.

• Partner with leadership to establish a holistic and integrated approach for managing  information security risks to strategy and global portfolio delivery. Setting, reviewing, communicating and training related Policies and evaluating their effectiveness as well as driving their implementation. Establishing security KPIs and KRIs.

• Using a risk-based approach, define information security priorities and enable decisions on risk tolerance and allocation of resources for control, mitigation, risk transfer and recovery.

• Establish and manage capabilities to track and analyze current, emerging and future cyber threats and vulnerabilities, and recommend how to manage them effectively.

• Drive a culture of openness and accountability, resulting in proactive risk escalation and effective mitigation with clear ownership allocation. Lead by example.

• Ensure that sound governance is in place to continuously improve UNOPS security posture and benchmark it against relevant peers. Empower and train the organization on effective methods to take ownership over risk assessment, mitigation and continuity planning.

• Provide advice and recommendations on managing information security threats and incidents. This includes helping to improve UNOPS systems, IT security practices, due diligence, crisis management and related enabling capabilities.

• Provide leadership with timely reporting on information security risks, issues and mitigations and their implications to the organization. Ensure alignment with the overall risk management framework, reporting principles and expectations of UNOPS’s governing bodies

• Provide assurance on the implementation of plans/recommendations, working closely with relevant stakeholders (such as Internal Control and Internal Audit). This includes verifying that controls work effectively: e.g. system vulnerabilities and security breaches can be detected and responded to effectively within a reasonable time frame.

• Across the activities, raise awareness of and ensure alignment with applicable international standards for information security, risk management, business continuity and incident management.

Summary of functions:

• Strategic information security advice and insights

• Capability building and communication

• Information security management, assurance and oversight

Strategic information security advice and insights

• Define the vision for an optimized information security capability, in line with UNOPS operational model, project portfolio, risk appetite, IT strategy,applicable regulation and international good practice standards. 

• Partner with leadership to establish a holistic and integrated approach for managing  information security risks to UNOPS strategy and global portfolio delivery.

• Review existing roadmaps to ensure they are in alignment with the vision and approach.

• Identify and advise on mechanisms for driving the culture of accountability and information security becoming part of UNOPS organizational DNA.

• Provide subject matter expertise into the UNOPS digitalization agenda, ensuring “security by design”.

• Build business cases for security investments and manage associated budgets.

• Work in collaboration with the regions and corporate functions (e.g. Partnerships, Implementation Practices & Standards and Integrated Practice Advice & Support) in embedding information security into engagement development, contracting and delivery. Support associated due diligence and identify de-risking and business growth opportunities.

• Partner with relevant process owners to ensure embedding of information security standards, appropriate management approaches and reporting mechanisms. Propose corrective actions for non-compliance with information security Policies and monitor their implementation.

• Act as lead expert on securing specific technology solutions and platforms including but not limited to Google Cloud Platform and ERP systems, and deploying dedicated security solutions (e.g. SIEM, DLP, MDM, IAM). Work closely with IT in ensuring that secure system development protocols and competences are effectively in place.

• Provide advice on the application of international standards (e.g. ISO, NIST and COBIT).

• Provide advice to a broad range of stakeholders on data classification, data loss prevention, asset inventory, security architecture, vulnerability management, patch management, incident and problem management related protocols, methods and tools.

• Oversee the work of the Security Operations Center and its performance.

• Ensure that  phishing tests are performed regularly to verify awareness. Build associated initiatives working closely with the CRO and UNOPS communications team. Consult leadership for the most effective and appropriate communication strategy.

• Continuously improve the organisation’s capacity to detect and respond to cyber attacks (multi-vector across technology, process, human and physical), including developing metrics to track the effectiveness of defensive capabilities.

• Support reviewing, testing and improving business continuity and disaster recovery plans.

• Address potential “false sense of security” through security testing (e.g. internal and external penetration testing, red & purple teaming and war-gaming), verifying that countermeasures work effectively across technology, people, processes and physical domains.

• Maintain ongoing intelligence on the cyber threat landscape. Advice leadership on associated risks to operations. Use scenario analysis, case studies, bow ties and exposure quantification to articulate complex, technical themes in “business language”, enabling decision making.

• Define information security risk metrics that “tell stories” to which business leaders can relate, moving beyond compliance and audit focused to a risk-driven approach to security.

• Implement robust governance mechanisms for monitoring information security practices, surfacing risks, reporting them and monitoring progress in mitigating against them. Ensure timely risk and incident escalation that follows a threshold-based approach.

• Oversee the implementation of information security related roadmaps and KPI achievement.

• Provide assurance over the implementation of recommendations/improvements, including their effectiveness in addressing the information and system security threats.

• Provide status updates of any open roadmap, audit and regulatory items.

• Support Internal Audit in operating an effective IT Audit capacity that provides independent assurance over the effectiveness of Information Security Management System and management of key security risk exposures.  

• Optimize portfolio of service providers with accountability for quality assurance.