Information Security Assurance Officer (ISAO)

Position

Information Security Assurance Officer (ISAO)

Group

Information Security Officer (ISO), Risk (Second Line), London

Reports to

Head of Information Security (HoIS)

Direct reports

0

Internal relationships

• Chief Risk Officer (CRO) and Risk Teams (Second Line)
• Chief Technology Officer (CTO)  (First Line)
• IT Security Team
• Other IT Teams
• Chief Operating Officer (COO) and Operations Teams (First Line)
• Payments
• Data Team
• Operational Resilience
• NBK Group Information Security Office (GISO) (Kuwait)

External relationships

• Auditors  (Internal, External)
• Third-Party Business and Service Suppliers 

Job purpose

The Information Security Assurance Officer (ISAO) works within the second line NBKI Information Security Office (ISO) leading assurance activities on NBKI’s infrastructure and systems ensuring Bank’s business operations are adequately protected. Employing a risk-based security approach, the ISAO, along with HoIS, continually review controls, identify threats, recommend and oversee improvements to the Bank’s security posture.

Working within financial services requires NBKI to be proactive in assuring that both internal and externally supplied systems are continually reviewed, assessed and any vulnerabilities remediated. The ISAO coordinates this activity, liaising with both UK and Kuwait based third parties to plan, deliver and remediate outsourced assurance, sensitively handling discussions, negotiations and meetings, escalating to HoIS as required.

The ISAO is a core member of the Bank’s Information Security Team, contributing to the Information/Cyber Security Strategy and Roadmaps, enabling both defence-in-depth and, where appropriate, defence-in-breadth to safeguard normal banking operations. There is a requirement for the ISAO to continually expand their Information Security knowledge, through internally sponsored training and attendance at external industry events. 

Key Responsibilities 

• Deputise for HoIS, briefing Information Security, EMC and Board Committees as required.
• Liaise with Third Parties to plan and monitor assurance activities on NBKI Core Systems, Platforms and capabilities.
• Collaborate with HoIS on Data Loss Prevention (DLP) to protect client, staff and Bank sensitive information from leakage or loss.
• Work with HoIS to evaluate information security risks for new projects, products, systems, and other significant changes within NBKI.
• Assist HoIS in creation and review of NBKI Information and Cyber Security governance, developing, reviewing, and helping maintain information security governance policies, standards, frameworks, and procedures.
• Improve NBKI Information Security by analysing current controls and governance and recommending improvements, innovation and change.
• Lead annual PCI-DSS re-certification and assist with SWIFT re-certification as required.
• Act as secretary to NBKI’s Information Security Committee.
• Lead audit activities as required, coordinating the submission of evidence from the various NBKI departments; own specific audit actions from identification to resolution.
• Participate in the creation and delivery of  Information/Cyber Security Awareness training, educating NBKI staff on best practices.
• Support the ISO in annual budgeting and planning.
• Participate in Cyber Incident Response as part of the ISO Team.

Qualifications, Experience, Skill and Competencies

Essential

• Willingness to learn and expand own skills in Information Security, Banking and Financial Services in general.
• Ability to work autonomously and flexibly within a team, contributing to an improved Bank security posture.
• Strong initiative to examine and review the Bank’s Attack surface, analyse and interpret data to provide insights to the most likely threats facing the bank.
• At least 3 years’ Information Assurance experience and/or working within a highly regulated UK sector.
• Information Security qualification (degree, CISSP, or CISM) obtained or in progress.
• Working knowledge of NIST CSF 2.0 and ISO 27K.
• Strong technical acumen with broad knowledge across Information/Cyber Security, Software Development, and IT systems.
• Awareness of common Cyber Incidents and Security breaches (OWASP).

Desirable

• Hands on experience with Information Security tools, such as Purview and CrowdStrike. 
• Experience delivering cyber security briefings to Staff/Leadership Teams.
• Experience in working with Information Security Risk Registers / Risk Control Self Assessments (RCSAs).
• Previous experience working within an organisations Cyber Incident Response function.
• Knowledge or experience in Three Lines of Defence model, SOC2, PCI DSS and GDPR.

Key Success Factors

• Ability to plan activities and events against moving requirements and timelines.
• ‘Can do’ attitude with willingness to step out of own comfort zone and contribute to Bank continual improvement
• Good IT, written and oral communication skills.
• Effective time management and ability to prioritize tasks.
• Strong analytical and problem-solving skills.