Cyber Security Specialist

Job Purpose
To support the development, implementation, and monitoring of the organization’s cyber security framework to protect business systems, customer information, financial data, and digital assets from cyber threats. The role ensures compliance with regulatory requirements, manages security risks, supports incident response and business continuity initiatives, and promotes security awareness across the organization.

Key Responsibilities
1. Cybersecurity Governance and Strategy\: Assist in the development, implementation, review, and continuous improvement of cybersecurity policies, standards, procedures, and controls, ensuring alignment with the Company’s risk appetite, business objectives, and regulatory requirements.
2. Security Monitoring and Threat Management\: Lead and coordinate the monitoring of networks, applications, endpoints, cloud environments, and security tools to identify, analyse, and respond to cyber threats, vulnerabilities, and emerging security risks.
3. Incident Response and Cyber Recovery\: Coordinate cybersecurity incident response activities, including investigation, containment, eradication, recovery, root-cause analysis, and lessons learned, while ensuring timely escalation and reporting of significant incidents.
4. Cyber Risk and Vulnerability Management\: Coordinate regular cybersecurity risk assessments, vulnerability assessments, penetration testing, and security audits, ensuring identified weaknesses are appropriately prioritized, remediated, and tracked to closure.
5. Data Protection and Privacy\: Ensure appropriate cybersecurity controls are implemented to protect sensitive customer, employee, financial, policyholder, claims, and other insurance-related information in accordance with applicable data protection, privacy, regulatory, and Company requirements.
6. Identity and Access Management\: Oversee and strengthen user access management, identity and authentication controls, privileged access management, access reviews, segregation of duties, and timely removal or modification of access rights.
7. Infrastructure and Technology Security\: Work closely with the IT team and technology stakeholders to ensure secure configuration and protection of servers, networks, endpoints, applications, backup systems, cloud environments, and other critical technology infrastructure.
8. Security Awareness and Culture\: Coordinate cybersecurity awareness initiatives, including phishing simulations, security training, user education, and communication campaigns, to strengthen employee awareness and promote a strong information security culture across the Company.
9. Third-Party and Vendor Security\: Coordinate cybersecurity due diligence and security assessments of vendors, technology partners, and other third parties, ensuring appropriate security requirements, contractual controls, risk mitigation measures, and ongoing monitoring are in place.
10. Cybersecurity Compliance and Assurance\: Ensure cybersecurity controls and practices remain aligned with applicable regulatory requirements, industry standards, internal policies, and audit recommendations, including supporting internal and external audits.
11. Cybersecurity Reporting and Management Information\: Prepare and present cybersecurity dashboards, risk reports, incident reports, compliance updates, vulnerability reports, and management information to senior management and relevant governance committees.
12. Business Continuity and Cyber Resilience\: Support the development, testing, and continuous improvement of cybersecurity-related business continuity, disaster recovery, backup, and cyber-resilience measures to ensure the availability and recovery of critical insurance operations.
13. Security Improvement and Technology Enhancement\: Identify opportunities to strengthen the Company’s cybersecurity posture through improved controls, processes, technologies, and security solutions, and support the implementation of approved cybersecurity initiatives.
14. Team Coordination and Leadership\: Provide technical guidance and day-to-day coordination to cybersecurity and IT support resources, promote accountability, and contribute to the development of cybersecurity capabilities within the team.
15. Regulatory and Stakeholder Engagement\: Support engagement with regulators, auditors, service providers, and other relevant stakeholders on cybersecurity, information security, data protection, and technology risk matters, ensuring timely responses and closure of agreed actions.