Position: CISO
Company: Kyrrex
Category: Security
Experience required: 2y
English level: upper

**Qualification:**
 
— Mandatory requirements 2+ years of experience in IT-security.
— Good knowledge of computer network technology and standards (VLAN, IP-addressing, trust zones, etc.) is required.
— Experience in management of Windows, Linux and Cloud systems.
— Understanding of common network attack types and security threats (DNS poisoning, ARP poisoning, DdoS, XSS, CSRF, SQL injection, etc.) as well as protection measures.
— Good knowledge of common vulnerabilities in popular operating systems, web-services and programs, including patch management procedures.
— Practical experience with IT-security in Clouds (secure access, data leak prevention, multi factor  authentication, data permission management, web application firewalls, IT-security compliance audit, IT-security events investigation, data encryption, etc.)
— Experience in IT-security audit and penetration testing.
— Experience in code review from IT-security perspective, knowledge of main principles and standards in this area such as OWASP. Scanning program source code for vulnerabilities, testing, approving for production exploitation.
— Experience in operating systems and database protection.
— Understanding of security principles under software development.
— Basic programming skills (C++, Python, Perl, Bash, etc.)
— Cyber security events and incident investigation skills.
— Good knowledge of IT-security standards and methodology (ISO27x, SOC 2, NIST, ITIL, Cobit, PCI-DSS, etc). 
— Good knowledge of regulatory authorities requirements.
— Practical experience in different IT-security instruments such as sniffers, traffic analyzers, vulnerability scanners, etc.
— Experience in developing and implementing IT-security policies and procedures, managing business continuity and anti-crisis management.
— If candidate has some IT-security certification such as CISSP, OSCP, CEH, CompTIA Security, GIAG it would be considered as plus.
— Good knowledge of English language (writing and speaking),
— Proactive, initiative and command player person.

**Responsibilities:**
 
— Develop, implement and provide process control of complex system information protection in the Company regarding to ISO27001, ISO27002, ISO27005 and SOC 2 standards.
— Develop and implement corporate strategy of managing information security risks (IT-security) for threats preventing or resisting.
— Carry out regular IT-security audits in the Company and participate in IT-audits made by third party audit companies.
— Define potential threats and vulnerabilities, develop and implement protection measures (solutions, programs).
— Review of security events and incidents, analyze and investigate IT-security incidents, define events priority and separate real threats and vulnerabilities from false positive cases.
— Collect, analyze and systematize information about Company information assets.
— Participate in planning and developing of Company IT-infrastructure. Take part in projects of developing new and updating existing Company software assets from IT-security perspective.
— Develop and implement model of role based access to Company software, systems and services, provide and control its implementation.
— Provide monitoring and control of Company security systems (Firewall, Proxy servers, Antivirus, PKI, VPN, logging, incidents investigation, etc.)
— Provide control and management of data encryption.
— Provide business continuity and anti-crisis management.
— Develop and maintain Company documentation about business continuity and anti-crisis management.
— Provide analysis of impact of negative factors on the Company processes and risk management (BIA)

**We offer:**

— A cool, relevant and very technological product
— Interesting work, great team, great opportunities for growth
— Flexible work schedule (remote, there is also an office in Kyiv)
— Stable salary