Key Responsibilities
- Monitor systems, logs, and access reports to detect security breaches, policy violations, or employee misconduct
- Maintain and continuously improve the Information Security Management System (ISMS) in line with ISO 27001
- Conduct risk assessments and maintain the Statement of Applicability (SoA)
- Enforce compliance with security policies (Acceptable Use, Access Control, Data Classification, etc.)
- Lead internal audits and prepare documentation/evidence for ISO 27001 certification and surveillance audits
- Investigate, document, and escalate security incidents and suspected employee misconduct
- Manage corrective and preventive actions (CAPA) resulting from audits or incidents
- Coordinate security awareness training and track employee compliance
- Liaise with IT, HR, and Legal on access control, disciplinary matters, and incident response
- Report on security posture, incidents, and compliance status to senior management