أخصائي أول ضمان الأمن السيبراني وتقنية المعلومات والمخاطر

Job Purpose

The purpose of the IT Cyber Security Assurance and Risk Specialist role is to continuously improve the protection of information systems by preventing unauthorized disclosure or modification. This involves coordinating with system owners and internal stakeholders to enhance Nawah's security posture

Key Activities, Responsibility & Accountability

• Scope and perform penetration testing on systems, networks, and applications to identify vulnerabilities.
• Utilize manual and automated testing methods to find and exploit code flaws, misconfigurations, and insecure software.
• Use penetration testing tools and frameworks such as Metasploit, Nmap, Nessus, Burp Suite, Wireshark, Air crack-ng, SQL map, Tenable, John the Ripper, Hydra, OWASP ZAP, SOAP UI, Echo mirage etc.
• Write clear and concise penetration testing reports detailing findings and recommendations.
• Plan and provide technical trainings to junior team members for their professional development and growth.Perform On demand and scheduled security assessments on enterprise solutions
• Perform Red team activities including but not limited to exploitation of identified vulnerabilities, perform breach attack simulations, phishing campaigns, collaboration with blue team to improve monitoring and defence measures.
• Lead the vulnerability management program by performing scheduled and on demand vulnerability assessments, vulnerability reporting, vulnerability prioritization, provide recommendations for remediation of identified vulnerabilities, validate remediation of mitigated vulnerabilities,
• Work on Endpoint Detection and Response tool for operations and investigations.
• Perform Secure Architecture Reviews for upcoming projects.
• Conduct technical investigations of cybersecurity events and incidents, designing and recommending effective mitigations
• Stay updated on the latest security trends, threats, and technologies.
• Provide technical guidance and support to IT teams on security-related matters.
• Keep cybersecurity training and knowledge current by monitoring the latest security threats and vulnerabilitiesDevelop and implement cloud security strategies and plans to protect cloud-based systems, networks, and data.
• Work in collaboration with IT teams to ensure the security of all cloud systems,
• Identify and mitigate potential threats and vulnerabilities within the cloud environment.
• Ensure compliance with industry security standards and regulations for cloud environments.
• Conduct security assessments through vulnerability testing and risk analysis specific to cloud infrastructure.
• Monitor cloud environments for irregular activities and potential security breaches.

Responsibilities & Accountabilities (contd.)

• Provide technical support and guidance in relation to cloud security.
• Stay updated on the latest cloud security trends, technologies, and best practices.
• Conduct regular security audits to identify potential weaknesses in cloud infrastructure.
• Support the Audit teams during audit with required evidence.
• Verify compliance to organization and regulatory requirements while onboarding of a new solution within the organization
• Represent Information Security Assurance Team in Enterprise Design Authority meeting and Enterprise Change Management Board meeting to ensure proposed changes and design comply to organization and regulatory requirements.
• Provide strategic recommendations to enhance the organization’s overall security posture

Qualifications

Bachelor’s Degree

Experience

3 years’ experience, Diploma, Military or Police Academy graduate with 8 years’ experience, or High School with 10 years’ experience

CEH, ECSA, OSCP, CISSP, GPEN, Cloud Security Certifications