Senior Information Security Officer

Job Identification (Reference Number)**:15176**
Position Title**:Senior Information Security Officer**
Duty Station City**:Valencia**
Duty Station Country**:Spain**
Grade**:P-4**
Contract Type**:Fixed-term (1 year with possibility of extension)**
Recruiting Type**:Professional**
Vacancy Type**:Vacancy Notice**
Initial duration**:1 year with possibility of extension**
Closing date**:22 June 2025**

Introduction:
Established in 1951, IOM is a Related Organization of the United Nations, and as the leading UN agency in the field of migration, works closely with governmental, intergovernmental and non-governmental partners. IOM is dedicated to promoting humane and orderly migration for the benefit of all. It does so by providing services and advice to governments and migrants.

IOM is committed to ensuring a workplace where all employees can thrive professionally, while working towards harnessing the full potential of migration. Read more about IOM's workplace culture at IOM workplace culture | International Organization for Migration

Applications are welcome from first

Antigua and Barbuda, Bahamas, Barbados, Comoros, Congo (the), Cook Islands, Dominica, Federated States of Micronesia, Grenada, Guinea-Bissau, Holy See, Iceland, Israel, Kiribati, Lao People's Democratic Republic, Madagascar, Marshall Islands, Namibia, Nauru, Palau, Saint Kitts and Nevis, Saint Lucia, Samoa, Sao Tome and Principe, Seychelles, Solomon Islands, Suriname, Tonga, Tuvalu, Vanuatu

**Context**:
RESPONSIBILITIES
Lead and manage the cybersecurity Blue Team functions, processes and team members.
- Ensure that the information security and risk management functions, processes, procedures, training sessions, and playbooks are developed, implemented, auditable and repeatable, as well as aligned with business and strategic organizational objectives.
- Improve the maturity level of data security to the defined higher level, and evaluate and advise on progress, risk monitoring and performance,ensuring the development of Key Performance Indicators (KPI)/metrics.
- Lead the response to security audit requests and provide advisory services to ensure the implementation of recommendations (including FISMA/NIST 800-53 controls, ISO 27001).
- Define and coordinate the implementation of the Global Cybersecurity Strategy, including the formulation of awareness-related activities and delivery of global workshops / webinars.
- Create security policies and procedures based on ISO27001, NIST 800-53 and Computer Information System (CIS) controls.
- Conduct complex threat, vulnerability, risk and compliance assessments, audit information security controls, simulate cyber-attacks and data breaches, and provide authoritative advice on cybersecurity governance, risk and compliance practices as well as change management.
- Lead and manage a variety of cyber security projects, including the management of resources.
- Carry out complex and/or sensitive investigations and audits.
- Provide authoritative advice to queries/requests/tickets related to data security, risks, rotation, access and other information security matters.
- Provide authoritative advisory services for decision-making activities related to information security topics.
- Perform such other duties as may be assigned.

**QUALIFICATIONS
Education**
- Master’s degree in computer science, information systems, mathematics, statistics or related field from an accredited academic institution with seven years of relevant professional experience; or
- University degree in the above fields with nine years of relevant professional experience.
- Professional certification such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Chief Information Security Officer (CCISO), Certified Secure Software Lifecycle Professional (CSSLP), Governance, Risk, and Compliance Professional (GRCP), Project Management Professional (PMP), or related will be a distinct advantage in addition to leaders
- Information Technology Infrastructure Library (ITIL) and Prince2 Foundation are added advantages.

Accredited Universities are those listed in the UNESCO World Higher Education Database.

**Experience**
- Extensive experience in building a cybersecurity defensive team (BLUE TEAM);
- Extensive experience in building a cybersecurity governance, risk, and compliance practices;
- Extensive experience in creating policies, standards, and guides;
- Extensive experience in simulating cyber-attacks and data breaches;
- Experience managing projects and teams; and,
- Experience defining security strategies aligned with business and strategic objectives.

**Skills**
- Strong interpersonal skills;
- Solid organization and document, project management;
- Strong investigative skills;
- Strong ability to continue to learn and grow;
- Basic knowledge of reporting tools (e.g., MS Excel, Power BI, Power BI Report Builder);
- Demonstrated skill in creating security policies and proc