Position: Information Security Specialist
Company: AMC Bridge
Category: Security
Experience required: 3y
English level: intermediate

MINIMUM EXPERIENCE: 3 years of working in IT and security.
REQUIREMENTS:
•	Practices and methods of IT strategy, enterprise architecture and security architecture;
•	Security concepts related to DNS, routing, authentication, VPN, proxy services and DDOS mitigation technologies;
•	ISO 27000, ITIL and COBIT frameworks - desirable
•	Windows, UNIX and Linux operating systems;
•	Firewall and intrusion detection/prevention protocols;
•	Secure coding practices, ethical hacking and threat modeling;
•	TCP/IP, computer networking, routing and switching;
•	Network security architecture development and definition;
•	Knowledge of third party auditing and cloud risk assessment methodologies;
•	Intermediate level of English skills

DUTIES:
1. Lead in the development/adoption and enforcement of Information Security policies, procedures and standards. 

2. Maintain the AMC Bridge Security Policies. These are formal policies that detail and document actual mechanisms and controls and should include the following:
• Administrative Policies: Risk analysis and management, documentation management and controls, information access controls and sanctions for failure to comply;
• Personnel Security Policies: Personnel only have access to the sensitive information for which they have appropriate authority;
• Physical Safeguards Policies: Assign security responsibilities, control access to media and the controls in place against unauthorized access to workstations, servers, network and related equipment;
• Technical Security Policies: Set the access and authorization controls for everyday operations as well as emergency procedures for data.
• Transmission security Policies: Set the standards for access controls, audit trails, event reporting, encryption and integrity controls.

3. Maintain the AMC Bridge Security Procedures that include:
• Evaluation and compliance with security measures.
• Disaster Recovery and Emergency operating procedures.
• Security Incident Response and process protocols including Incident Reporting and Sanctions.
• Testing of security procedures, mechanisms and measures.

4. Maintain appropriate security measures and mechanisms to guard against unauthorized access to electronically stored and /or transmitted patient data and protect against reasonably anticipated threats and hazards.

5. Oversee and/or assist in performing on-going security monitoring of organization information systems including:
• Assess information security risk periodically;
• Evaluate and recommend new information security technologies and counter-measures against threats to information or privacy.

6. Ensure compliance through adequate training programs and periodic security audits. These audits should be both internal and external in nature.