Cybersecurity Architecture

Responsibilities:

The position requires an understanding of information security architecture, security

requirements for IT projects and deployments, and ability to run and evaluate security solutions.

Specifically, the resource will perform the following responsibilities under the guidance and

supervision of the Senior IT Specialist (Information Security):

• Facilitate the end-to-end security clearance process (SLtO – Security License to

Operate) for new solution deployments and IT projects by working closely with

project/deployment teams to understand the security architecture, draft the security

clearance checklist by identifying which security checks are applicable based on the

nature of the IT project/solution and give guidance on how to fulfill these requirements;

• Oversee the end-to-end penetration testing process

applications and infrastructure, which includes the administrative tasks (RFP – Request

for Proposal from pentest firms, onboarding, scheduling of walkthrough meetings and

pentest proper, and filing requests for user and network access as needed), ensuring that

pentest findings are addressed and well-documented, and ensuring that pentest

engagements are closed properly.

• Assess the day-to-day RFCs (Requests for Change), enhancements to existing

solutions, and other ad hoc consultations for security requirements.

• Work closely with project/deployment teams, CAB administrators and relevant parties to

guide them in fulfilling security requirements.

• Work closely with IT Risks focal and action owners to monitor and close operational risks

(i.e. risks identified after go-live)

• Manage security tools, such as WAF (Web Application Firewall). Lead the process and

tool improvement initiatives

• Manage e-Signature tools, serve as L1 support for business users and coordinate with

vendor for technical support as needed

• Lead a sub-team focused on Cybersecurity architecture compliance, penetration testing

process, security requirements for changes and security research-related tasks;

• Support the cyber security due diligence process for third party IT solution providers;

• Develop, update, or revise Cybersecurity Architecture guardrails, processes and

procedures

• Develop security training materials, such as presentations and handouts, as needed;

• Spot opportunities to improve or strengthen security controls or processes in own areas

of work;

• Conduct risk assessments from a security architecture perspective;

• Draw up technical evaluation criteria for evaluating security solutions;

• Coordinate the conduct of Requests for Information (RFIs) and Proofs of Concept (POCs)

on security technologies; and

• Other duties that may be assigned by the supervisor.

Qualifications:

• Have a good working knowledge of and at least 6 years of IT Security and/or Security

Architecture experience.

• Have experience and knowledge in conducting security risk or security architecture

assessments.

• Bachelor's degree in any IT-related major and security-related certifications such as

CISSP, CISM, GSEC, CEH or equivalent (or extensive, relevant experience).

• Broad range of knowledge of Information and Communications Technology as applied in

an enterprise environment.

• Should possess ability to design security architecture, coordinate requirements

development, and solutions definition.

• Knowledgeable on cyber security and IT governance frameworks such as NIST CSF,

SWIFT CSP, CIS Benchmark, OWASP, COBIT, ITIL, and ISO 27000 series. Actual

experience in their implementation and operation is an advantage.

• Knowledge of cloud technologies such as Microsoft Azure, AWS is an advantage.

• Capable of security analysis that is typically needed in designing, reviewing, or

conducting assessments of security architecture, application functions and IT

infrastructure.

• Very attentive to details and methodical with work.

• Strong communication and interpersonal skills and ability to operate in a matrixed

environment.

• Ability to articulate ideas and present them meaningfully in a verbal or written context.

• Should have ability to handle multiple tasks and priorities.

• Should be able to establish good networking relationships with colleagues in own unit,

within ITD, and in some cases, outside of ITD.

• Should be able to anticipate security risks or issues, provide recommendations to the

supervisor on addressing those issues, or address the less complex ones.

• Should be able to guide more junior analysts.

• Carries out work independently and proactively with minimal supervision or follow up.

Responsibilities:

The position requires an understanding of information security architecture, security

requirements for IT projects and deployments, and ability to run and evaluate security solutions.

Specifically, the resource will perform the following responsibilities under the guidance and

supervision of the Senior IT Specialist (Information Security):

• Facilitate the end-to-end security clearance process (SLtO – Security License to

Operate) for new solution deployments and IT projects by working closely with

project/deployment teams to understand the security architecture, draft the security

clearance checklist by identifying which security checks are applicable based on the

nature of the IT project/solution and give guidance on how to fulfill these requirements;

• Oversee the end-to-end penetration testing process

applications and infrastructure, which includes the administrative tasks (RFP – Request

for Proposal from pentest firms, onboarding, scheduling of walkthrough meetings and

pentest proper, and filing requests for user and network access as needed), ensuring that

pentest findings are addressed and well-documented, and ensuring that pentest

engagements are closed properly.

• Assess the day-to-day RFCs (Requests for Change), enhancements to existing

solutions, and other ad hoc consultations for security requirements.

• Work closely with project/deployment teams, CAB administrators and relevant parties to

guide them in fulfilling security requirements.

• Work closely with IT Risks focal and action owners to monitor and close operational risks

(i.e. risks identified after go-live)

• Manage security tools, such as WAF (Web Application Firewall). Lead the process and

tool improvement initiatives

• Manage e-Signature tools, serve as L1 support for business users and coordinate with

vendor for technical support as needed

• Lead a sub-team focused on Cybersecurity architecture compliance, penetration testing

process, security requirements for changes and security research-related tasks;

• Support the cyber security due diligence process for third party IT solution providers;

• Develop, update, or revise Cybersecurity Architecture guardrails, processes and

procedures

• Develop security training materials, such as presentations and handouts, as needed;

• Spot opportunities to improve or strengthen security controls or processes in own areas

of work;

• Conduct risk assessments from a security architecture perspective;

• Draw up technical evaluation criteria for evaluating security solutions;

• Coordinate the conduct of Requests for Information (RFIs) and Proofs of Concept (POCs)

on security technologies; and

• Other duties that may be assigned by the supervisor.

Qualifications:

• Have a good working knowledge of and at least 6 years of IT Security and/or Security

Architecture experience.

• Have experience and knowledge in conducting security risk or security architecture

assessments.

• Bachelor's degree in any IT-related major and security-related certifications such as

CISSP, CISM, GSEC, CEH or equivalent (or extensive, relevant experience).

• Broad range of knowledge of Information and Communications Technology as applied in

an enterprise environment.

• Should possess ability to design security architecture, coordinate requirements

development, and solutions definition.

• Knowledgeable on cyber security and IT governance frameworks such as NIST CSF,

SWIFT CSP, CIS Benchmark, OWASP, COBIT, ITIL, and ISO 27000 series. Actual

experience in their implementation and operation is an advantage.

• Knowledge of cloud technologies such as Microsoft Azure, AWS is an advantage.

• Capable of security analysis that is typically needed in designing, reviewing, or

conducting assessments of security architecture, application functions and IT

infrastructure.

• Very attentive to details and methodical with work.

• Strong communication and interpersonal skills and ability to operate in a matrixed

environment.

• Ability to articulate ideas and present them meaningfully in a verbal or written context.

• Should have ability to handle multiple tasks and priorities.

• Should be able to establish good networking relationships with colleagues in own unit,

within ITD, and in some cases, outside of ITD.

• Should be able to anticipate security risks or issues, provide recommendations to the

supervisor on addressing those issues, or address the less complex ones.

• Should be able to guide more junior analysts.

• Carries out work independently and proactively with minimal supervision or follow up.