Chief Information Security Officer (CISO)

Job Summary

The Chief Information Security Officer (CISO) is responsible for leading and directing the global information security strategy, policy, and program for the organization. This role involves safeguarding the company's information assets, managing risks, and ensuring compliance with relevant regulations across all regions in which the company operates. The CISO will collaborate closely with the CIO, legal, privacy, and business leaders, as well as senior management, IT staff, internal and external auditors, and other stakeholders to update and enhance the existing security plan based on evolving business dynamics.

This position also involves overseeing global security architecture, engineering, and operations; managing and maturing the Governance, Risk, and Compliance (GRC) team; organizing and leading the Executive Security Council; ensuring compliance with global regulatory requirements; and continuously improving the organization's security posture while maintaining financial and operational efficiency.

Essential Functions

* Update and Implement Security Strategy: Refine and execute a global information security strategy that adapts to business dynamics and aligns with the organization's objectives and regulatory requirements across all regions, incorporating cybersecurity frameworks such as ISO 27001 and COBIT for IT-related risks and IT governance. Focus on improving the organization's overall security posture while balancing financial and operational efficiency.

* Global Security Architecture and Engineering: Lead the development and implementation of global security architecture and engineering strategies to protect the organization's information assets. Oversee the design, deployment, and management of security technologies and controls worldwide, including cloud security, AI & ML security, and data privacy, ensuring solutions are both effective and cost-efficient

* Global Security Operations: Direct the global security operations to ensure effective monitoring, detection, response, and recovery from security incidents. Implement and oversee advanced security monitoring systems and tools across all regions, optimizing for both security and cost-effectiveness.

* Oversight of Global GRC Team: Provide strategic oversight and management of the Governance, Risk, and Compliance (GRC) team, ensuring its maturation and alignment with the organization's global security objectives. Develop and enhance the GRC function to ensure effective governance, risk management, and compliance practices globally, while maintaining operational efficiency. Leverage metrics and share with the Cybersecurity and Senior Leaders to make data driven decisions.

* Third-Party Risk Management: Formalize and mature the third-party risk management program by establishing a comprehensive framework to evaluate, monitor, and manage risks associated with third-party vendors and partners across all regions. Ensure ongoing risk assessments, compliance reviews, and continuous improvement of third-party security practices, with a focus on minimizing costs and maximizing security.

* Regulatory Compliance: Manage and address compliance with NIS2 and other global regulatory requirements, including but not limited to GDPR, CCPA, and industry-specific standards. Oversee efforts to achieve and maintain CTPAT certification and any other relevant certifications globally, while ensuring efficient use of resources.

* Policy and Compliance: Maintain, enforce, and update global information security policies, standards, and procedures to ensure compliance with current laws, regulations, and industry standards in all regions. Strive for policies that enhance security while promoting operational and financial efficiency.

* Incident Response: Lead the global incident response team in identifying, investigating, and responding to security breaches and incidents. Regularly update and maintain an incident response plan that addresses regional and global considerations, ensuring rapid response capabilities with minimal impact on business operations and costs.

* Executive Security Council: Organize and lead the Executive Security Council, ensuring cross-functional and regional alignment on security priorities, strategies, and risk management. Facilitate regular meetings and provide guidance to senior leaders and board members on global security-related matters, balancing risk reduction with cost management.

* Security Metrics and Reporting: Oversee and enhance global security monitoring systems. Develop and implement security metrics to measure and report on the status of the global information security program. Provide regular updates to senior management and board members on security posture improvements, risks, incidents, and compliance with global regulatory requirements.

* Security Awareness: Foster a culture of security awareness across the global organization through ongoing training programs and communication initiatives, ensuring programs are both impactful and cost-effective.

* Collaboration: Collaborate closely with IT, legal, privacy, compliance, and business units to integrate security practices into organizational processes and projects on a global scale, emphasizing efficiency and cost-effectiveness.

* Auditor Collaboration: Work closely with internal and external auditors to support audits, address findings, and ensure that security controls are effectively designed, implemented, and maintained.

* Monitoring and Reporting: Oversee and enhance global security monitoring systems. Provide regular updates and reports to senior management on the status of the global information security program, focusing on both security posture improvements and cost management.

* Budget Management: Develop and manage the global information security budget, ensuring efficient allocation and use of resources across all regions, and optimizing for financial efficiency without compromising security.

* Vendor Management: Evaluate and manage relationships with global security vendors and service providers to ensure alignment with the organization's security objectives and cost-effectiveness.

* Other duties as assigned.