Position: Senior Information Security Consultant
Company: ELEKS
Category: Security
Experience required: 5y
English level: upper

**REQUIREMENTS**
Preferably 4+ years of experience in information security
Preferably 2+ years of experience in risk assessment
Preferably 2+ years of experience in audits
Experience in developing/maintaining ISMS
Knowledge of security frameworks/standards (e.g. ISO 27001, SOC2, NIST, HIPAA, PCI DSS, GDPR, ITIL, Cobit etc.). Ability to conduct readiness/gap assessments, provide recommendations
Understanding of international and Ukrainian information security laws/regulations
Understanding of GRC framework
Understanding of secure coding practices, ethical hacking, threat modeling, secure SDLC process
Understanding of DR / BCP
Experience in defining security requirements as well as evaluating and selecting appropriate information security controls
Understanding of IT and information security trends, challenges
Knowledge of security vendors, systems, and solutions
Ability to deal with incomplete, poorly defined, or undocumented requirements
Technical writing
English – Upper-Intermediate or higher

**PERSONAL CHARACTERISTICS**
Analytical mind set
Initiative and proactive
Responsible and reliable
Well-organized
Self-motivated
Ability to work in a team and as an individual
Process- and result-oriented vision

**RESPONSIBILITIES**
Create relevant information security policies and procedures
Develop both high- and low-level action plans for implementation of the information security policies and procedures maintaining the proper balance between business priorities, information security risks, and cost of controls implementation for the organization
Coach, advice and drive adoption of developed policies and procedures and implementation of the action plans
Establish and maintain strong relationships with both senior and operating level business leaders to ensure alignment to customer and business needs while prioritizing key initiatives
Coordinate the maintenance of the Information Security Risk Management process, coordinate risk assessment cycle implementation with respective risk and control owner definition and development of Risk Treatment plans
Support audit cycle implementation to be done through preparation of materials for audit conduction, coordination of audits, participation in audits. Organize and manage the communication of results to the Management Team and respective involved parties
Participate in the customer information security compliance process. Identify and analyze customer requirements related to information security
Arrange a preparation for the external information security audits. Participate in the audit passing process
Coordinate the process of the implementation of the corrective actions to address nonconformities found during internal and external information security audits
Provide supervision and guidance for the information security team
Promote the compliance mindset: organize the development and delivery of required communication campaigns, awareness programs and trainings for different focus groups and different internal and external stakeholders
Provide subject matter expertise in information security for internal and external requests