OQ- Expert, Cybersecurity & GRC

IDS – Digital Application & Cyber Security

Location:

Oman, Muscat

Budget control:
* OPEX and/or CAPEX and/or Revenue amount as relevant*

Reporting to:
Head, Digital Application & Cybersecurity

Direct reports: 0

Lead the execution of Cybersecurity programs at OQ8, under delegated authority of Manager Outsource Service Management, as owner of Cybersecurity standards & solutions, through: (1) Lead the maintenance of security of networks and data and keep tabs on the systems employed by OQ8, reporting any issue(s) to management, (2) Lead the Cybersecurity Policies and Standards (IT/OT), (2) Support the cyber security management process by assessing the adequacy of risk management, information security and business continuity / disaster recovery controls of the company, and (3) Lead the Cybersecurity Governance;

in order to support Information Management & digital Transformation at OQ and PT&C stream to ensure the continuity and efficiency of the business.

The position will act in accordance with the OQ8’s Mission, Vision, Values & Strategies, as well as, policies, guidelines and standards, supported by an IT Technology platform, HSE standards, Omani’s government & other legal justification’s, and best international practices in consonance with national objectives

• Responsible for the assessing and documenting of the company’s compliance and risk posture as they relate to its information assets.
• Conduct and/or participate in Information Security Control assessments
• Author information security specifications. Supports the development and implementation of the system-wide risk management function of the information security program to ensure information security risks are identified, quantified and monitored.
• Internally assess, evaluate and make recommendations to management regarding the adequacy of the security controls for the company's information and technology systems
• Authors or updates GRC Operational Procedures associated with Information Security Assessment support the Operations associated with Information Security Awareness Program
• Supports GRC Privacy assessments responsibilities
• Ensures implementation of risk management processes associated with project or control implementations
• Participate in GRC projects associated with Cyber Security controls or Cyber Security Operations
• Lead the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies and regulations.
• Participate  develop and implement effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.
• Execute strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors.
• General Risk Management Responsibilities:
  Has good knowledge of applicable risk management practices required to create a
• Reviews IT risk assessments, analyses the effectiveness of information security control activities, and reports on them with actionable recommendations.
• Provides subject matter expertise in the area of cyber risk controls requirements
• Provides specialist cyber risk expertise to support IT projects and operational teams
• Prepare reports for senior management and external regulatory bodies as appropriate
• Participate as full member of IT emergency response team, on-call as per rotation
• Coordinate and track all information technology and security related audits including scope of audits, units involved, timelines, auditing agencies and outcomes. Work with auditors (state, internal, external) as appropriate to keep audit focus in scope, maintain excellent relationships with audit entities and provide a consistent perspective that continually puts the company in its best light. Provide guidance, evaluation and advocacy on audit responses.
• Provide policies, processes and oversight that defines the structure by which the organization security needs and controls are directed and managed
• Manage the security of industrial control and automation systems devices,…