Job description
1. Manage information security systems:
- Lead and manage the entire information security system, including network security monitoring, data security systems and other security measures to protect IT systems from internal and external threats.
- Manage and monitor the deployment of security tools such as SIEM, IDS/IPS, firewall, and other security solutions to monitor and prevent cyber attacks.
2. Monitor and detect security risks:
- Continuously monitor systems to detect security threats and promptly handle security incidents.
- Investigate cyber security incidents, coordinate with relevant teams to identify root causes and implement remedial measures to prevent similar incidents in the future.
3. Ensure compliance with security standards and regulations:
- Ensure IT systems comply with international security standards (such as ISO 27001, GDPR) and current legal requirements.
- Coordinate with relevant departments to develop, implement and update the company's information security policies, procedures and regulations (ITGC).
4. Manage relationships with security partners:
- Work closely with security service providers such as SOC (Security Operations Center) to monitor security systems 24/7 and ensure early detection of security threats.
- Manage and monitor independent penetration testing units (Pentest), and direct internal Pentest personnel to coordinate assessments, reconcile results and promote remediation of security vulnerabilities across the entire system.
- Monitor and evaluate the quality of services from external partners, ensuring these services meet the company's security needs.
5. Train and raise security awareness:
- Develop training programs and raise information security awareness for employees, ensuring all company members understand their role in protecting information.
- Ensure that security procedures are properly applied in all IT activities of the company.
6. Analyze and assess risks:
- Periodically assess security risks to the company's IT systems and propose appropriate preventive measures.
- Coordinate with other departments to assess and mitigate security risks, including managing risks from third parties.
7. Build and maintain compliance with governance and system operations
- Lead the development of internal governance systems for the Department: Regulations, Procedures, Forms, Implementation Rules (Checklist) for work, etc., propose adjustments to the Permission Matrix appropriate for operations in each period to ensure internal operations, inter-departmental coordination are continuous, accurate, fast and bring optimal efficiency.
- Develop and implement internal professional training plans for the Department to improve professional capacity and develop successor personnel.
- Comply with internal rules/regulations/documents of the Corporation. Manage data/information/professional records and documents related to internal operations of the Department. Synchronize data towards digitalization and AI-ization of the entire professional business governance system.
- Identify, assess, control and mitigate risks arising in daily activities at the Unit; report to the Risk Management, Process and Compliance Department the risks arising according to internal policies and regulations on risk management.
- Manage and take responsibility for issues related to tools and assets that the Department uses, operates and manages.
Requirements
1. Qualifications:
- Bachelor's degree in IT, Cyber Security, Information Systems, or related fields suitable for job requirements
- Certifications related to security such as CISSP, CISM, CEH are an advantage.
- Deep understanding of international information security standards (such as ISO 27001, GDPR) and regulations related to data security.
2. Experience:
- At least 7 years of experience in information security and IT compliance, of which at least 3 years in a security management position.
- Practical experience in implementing and managing security systems, including SIEM, IDS/IPS, firewall, VPN, and other security tools.
3. Skills:
- Good leadership and team management skills, with the ability to coordinate and supervise security activities throughout the company.
- Risk analysis skills, security incident detection and effective problem-solving.
- Communication skills and ability to work with different departments to ensure compliance and security.
