Security Engineer

Role DescriptionResponsible for company-wide cybersecurity and related documents, process and record management to ensure that systems and products are safe and effective. Ensures data integrity, and that information is kept accurate and consistent unless authorized changes are made (and documented), and that confidentiality is upheld by protecting information from unauthorized access. Responsible for cybersecurity compliance and training throughout the Company.As our IT Security Engineer, you'll support us by taking the lead on cybersecurity and working with the team to perform ongoing operations, administration, and development of security systems, as well as implementing fixes that would protect our systems. You will continuously work towards high confidence and high accuracy detection rules leveraging abnormal or suspicious events.Cybersecurity Management 40%Drive development standards and processes related to cybersecurity compliance.Monitor all cybersecurity processes, operations and infrastructure, monitoring internal and external policy and regulatory compliance.Review and evaluate development designs (for existing products and during design phase for new products) to identify gaps in cybersecurity controls, and drive updates to any cybersecurity or compliance documentation.Liaise with internal and external stakeholders to prepare for SOC2 Type 2 and HiTrust). Drive cybersecurity audit strategy and readiness from a dev, security and devops perspective.Identify, implement and maintain all security tools and technology.Schedule (and ideally automate) internal vulnerability scans, remediating findings and ensuring accurate & timely reporting to satisfy PCI DSS requirements.Schedule annual Penetration Tests with external supplier(s) and ensure implementation of items identified in remediation plansplete required cybersecurity applications and records for large customers and audits, including reporting as required.Infrastructure Management 30%Drive and action where required the planning, installation, monitoring and maintenance of IT systems and infrastructure focused on cyber security including any penetration testing that is required.Design and execute short- and long-term initiatives to detect and prevent any security vulnerabilities in the IT infrastructure (cloud, security and devops) to meet current and future needs.Develop, execute and oversee procedures, policies and related training plans for cybersecurity project management and infrastructure administration.Conduct research and recommend changes in services, products, protocols, and standards to support development efforts and infrastructure procurement.Define software and hardware security standards in collaboration with stakeholders and owners for the provisioning of the development and IT infrastructure.Ensure appropriate security levels on network, infrastructure and servers are maintained, ensuring thatthe IT team follows the requirements set in line with cybersecurity standards.Implement cybersecurity continuous improvement programs.Crisis management - keeping stakeholders informed and actively working with teams to return service in the shortest possible time frame. This would include documenting all disaster recovery procedures.Effective management and optimisation of vendors (where applicable) as well as collaborating with the dev and IT teams as necessary.Risk Management and Compliance 20%Collaborate with divisional the RAQA team and Senior ManagersManagerst to define and centralize risks and put mitigation measures in place for new and existing products and services, from a cybersecurity and privacy perspective.Improve the automation of security controls.Work closely with the dev team on defining industry-standard processes and system requirements, identifying and proposing fixes to shortcomings in the development lifecycle, code reviews and scanning as well as infrastructure provisioning.Work with the dev team to ensure that security standards and policies are being set up and configured correctly, ensuring adherence to certifications and best-practice.Assist with remediations on risk items identified from security and preventative detection reviews to ensure compliance and ensure the security posture of the IT landscape is ensured at all times.Remediate audit items by putting measures in place to prevent the recurrence of findings. For example, by making sure that audit findings are resolved by the relevant personnel and that the resolutions are such that they prevent the item from reoccurring in the future.Manage internal and external audits as required with relation to cybersecurity.Maintain documentation for cybersecurity-related risks, processes and findings.QMS and Documentation 10%Manage annual cybersecurity roadmap, IT audit (internal and external) plan and calendar.Work closely with the Compliance team to gather and submit evidence for all security and IT audits.Proactively keep stakeholders updated on status, progress, risks and problems.Review and approve documented outcomes of Penetration Tests, Remediation Plans and required activities.Review and approve documented outcomes of Vulnerability Scans, Remediation Plans and required activities.Maintain cybersecurity documents and records in line with certification requirements.Maintain document