Head of Information Security & Enterprise Risk Management

Role Purpose The Head of Information Security & Enterprise Risk Management is a senior executive responsible for designing, governing, and continuously strengthening an enterprise-wide cyber security, information risk, and technology risk framework across a complex, multi-business, multi-technology environment . This role requires deep specialization in advanced cyber security architecture, global regulatory compliance, and large-scale risk governance . Key Responsibilities 1. Enterprise Information Security Leadership Design and own the enterprise-wide information security strategy , aligned with global standards (ISO, NIST, COBIT) and evolving threat landscapes Establish and govern security architecture across on-premise, cloud, hybrid, OT, and IoT environments Act as the final authority on cyber risk acceptance , escalation, and mitigation 2. Cyber Risk & Threat Management Lead advanced cyber threat intelligence, attack simulation, and incident response programs Oversee Security Operations Center (SOC) models, including SIEM, SOAR, threat hunting, and forensic investigations Lead crisis response for major cyber incidents , ransomware events, or data breaches 3. Enterprise Risk Management (Technology & Digital Risk) Integrate technology risk, cyber risk, data risk, and third-party risk into the broader ERM framework Conduct quantitative cyber risk assessments (e.g., FAIR methodology) Present risk scenarios and financial impact modeling to the Board and Executive Committee 4. Regulatory, Compliance & Governance Ensure compliance with global and cross-border regulations , including: GDPR, ISO 27001/27701 NIST CSF, PCI-DSS Industry-specific cyber regulations (financial, infrastructure, utilities, real estate, etc.) Lead internal and external audits related to information security and technology risk Serve as the primary regulatory and auditor counterpart for cyber and IT risk matters 5. Third-Party & Supply Chain Risk Establish governance for vendor cyber risk , cloud service providers, MSPs, and offshore partners Oversee due diligence, contract security clauses, and continuous monitoring programs 6. Leadership & Capability Building Build and mentor a highly specialized security and risk team (security architects, GRC experts, SOC analysts) Develop long-term cyber capability uplift programs Serve as trusted advisor to CEO, Board, and Group Executives Required Qualifications (Highly Specialized) Education Bachelors Degree in Computer Science, Cybersecurity, Information Systems, or Engineering Masters Degree in Cybersecurity, Information Assurance, Risk Management, or related field (strongly preferred) Mandatory Global Certifications Candidates must possess multiple of the following: CISSP (Certified Information Systems Security Professional) CISM (Certified Information Security Manager) CISA (Certified Information Systems Auditor) CRISC (Certified in Risk and Information Systems Control) ISO 27001 Lead Implementer / Lead Auditor Cloud Security Certifications (CCSP, AWS/Azure Security Specializations) Experience Requirements 15+ years of progressive experience in: Information Security Cyber Risk Management Enterprise Technology Risk Minimum 7–10 years in a regional or global leadership role Proven leadership across large, complex organizations (multi-entity, multi-system, multi-jurisdiction) The role requires hands-on experience in: Designing enterprise-scale cyber security programs across: Cloud, on-premise, hybrid, OT, and legacy systems Leading major cyber incident response at enterprise or regional level Implementing global security frameworks across multiple countries Presenting cyber risk in financial and strategic terms to Boards Managing cross-border data privacy and regulatory compliance Behavioral & Leadership Competencies Board-level gravitas and executive presence Ability to translate deep technical risk into business language Strong crisis leadership and decision-making under pressure Proven mentor and builder of local capability