Position: Senior Information Security Officer
Company: Spribe
Category: Security
Experience required: 3y
English level: pre

Duties/Tasks and Responsibilities

•	Develops and maintains security policies/procedures/guides.
•	Take an active role in driving internal security and privacy initiatives.
•	Supports and cooperates with internal risk assessments and security impact analysis.
•	Ensures that assigned information systems/IT infrastructure are operated, maintained and decommissioned of in accordance with approved security policies and best practices.
•	Authors or coordinates the development of required system security plans, Vulnerability management (VM)
•	Supports and executes continuous monitoring for assigned security systems and solutions.
•	Investigates information & cyber security related incidents.
•	Identifies STIGs, SRGs and/or Hardening Guides with Control Implementations.
•	Plans and integrates DevSecOps solutions and practices.
•	Develops system POA&Ms in response to reported vulnerabilities.

Basic/Practical qualifications

•	Experience in the relevant legislation (at least one domain), industry regulations and industry standards such as NIST CSF/RMF, ISO27001, CIS20, EU GDPR, PCI DSS, Cloud Security Alliance CCM, OWASP etc.
experience in one + global view
•	In-depth knowledge of the Well-architected frameworks and best practices of the major cloud providers.
•	Familiar with vulnerability assessment methods/tools including container scans, network scans, web application penetration testing and remediation methods.
•	Strong knowledge of IAM principles/solutions and zero trust approaches.
•	Experience implementing and administering security controls and solutions (at least two) - IAM, EDR/XDR, SIEM, ID/PS, PAM, ATP, WAF, Email/Web/API gateway. 
•	3+ years of engineering experience (multiple cyber security domains) - AppSec, SecOps, CTI, Security Architecture, Risk Assessment – VA, Pentest, Dast. 

Nice to have

•	2+ years of engineering experience (at least one domains) - AppSec, SecOps, CTI, Security Architecture, Risk Assessment – VA, Pentest, Dast. 
•	Security Certifications such as CISSP, OSCP, CCSP, AWS Security, SANS GIAC certifications, relevant vendor specific certifications or equivalent.