Qualifications & Experience:
- Bachelor's Degree in Information Systems Technology, Computer Science or related field (with equivalency by the Kuwait Ministry of Higher Education)
- Certification in Information security systems (CompTIA Security+) is preferred
- Minimum of 10 years of experience in a related field
- Proficient in English and Arabic.
Key Accountabilities:
IT Security Strategy and Business Continuity Support
- Implement and maintain the company's security short- and long-term strategy and deploy layers of protection to ensure that information assets, IT systems, and infrastructure are adequately protected and fortified.
- Coordinate with other IT employees at KFAS to deliver comprehensive IT security and business continuity support across various domains, including networking, systems, users, database management, quality assurance, security measures, business applications, and telecommunications. The goal is to minimize downtime of IT security-related components.
Information Security Governance
- Provide assurance of the IT security throughout KFAS in coordination with internal audit and compliance function to ensure objectivity and independence.
- Analyze network, report unusual activities, and organize investigations of security incidents/breaches and assist with disciplinary and legal matters associated with such breaches as necessary; Author and edit incident reports.
- Identify and understand potential threats and vulnerabilities and implement mitigations.
- Implement comprehensive metrics that enable the continuous monitoring of security effectiveness within an KFAS's IT system and infrastructure such as number of incidents, level of protection, and cost and return on protective measure.
Information Security Protocols
- Implement encryption technologies to protect sensitive data, both at rest in the databases and in transit during dataflow granting only authorized access.
- Profile users by implementing and using authentication mechanisms, access control, and role-based access control such as username and password systems, multi-factor authentication (MFA), and biometrics to authenticate their identities.
- Simulate a penetration test by coordinating cyberattacks scenarios with ethical hackers to identify vulnerabilities and weaknesses in systems and applications.
- Increase the build of automated processes in the areas of threat evaluation and remediation in response to the repetitive and most common breach of safety.
- Deploy emerging security tools to adapt to cloud and mobile-centric IT environments; This involves creating and enforcing personal device policies and security controls to allow employees and contractors to use their personal devices for work while maintaining security standards.
- Ensure implementation and hardening of security solutions such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) to protect the sensitive flow of data being exchanged.
- Put in place fundamental concepts of defense in depth to protect KFAS's information systems and data with multiple layers of security measures to withstand diverse types of threats.
- Ensure the upmost intermittent availability of systems and data by implementing redundancy, disaster recovery plans, and high-availability configurations to minimize downtime.
IT Security Awareness
- Develop and implement extensive IT security awareness programs, ensuring that IT security awareness is effectively communicated throughout KFAS.
- Define and implement business continuity plans. This includes by handling contingencies and disaster recovery plans, troubleshooting hardware and network malfunctions, and conducting relevant risk assessments to ensure continuity of the IT department operations, including systems and applications.
Vendor and Third-Party Relations
- Collaborate with vendors to assess the provision and implementation of IT security systems, and swiftly address any associated issues.
- Oversee contractors and third-party entities to ensure their compliance with established security protocols designed to protect sensitive information.
