Position information

Department: Information Technology / Cybersecurity
Reports to: Cybersecurity Manager
Direct reports:
Location: [Location]
Employment type: Full-time

Position purpose

The Head of Cybersecurity is responsible for leading the day-to-day cybersecurity function, managing cybersecurity operations, and overseeing the implementation of security controls across the organisation's Information Technology (IT) and Operational Technology (OT) environments. The role provides technical leadership to a small cybersecurity team and ensures cybersecurity risks are effectively identified, assessed, monitored, and mitigated.

Working under the direction of the Cybersecurity Manager, the Head of Cybersecurity is accountable for the execution of the cybersecurity strategy, governance requirements, security operations, compliance activities, and cybersecurity improvement initiatives.

Key responsibilities

Cybersecurity leadership

• Lead and manage the cybersecurity team, providing technical guidance, mentoring, and performance management.
• Coordinate cybersecurity activities across IT, OT, Digital, and business functions.
• Act as the primary escalation point for cybersecurity operational issues.
• Develop team capabilities, skills, and professional development plans.
• Foster a strong cybersecurity culture throughout the organization.

Security operations

• Oversee Security Operations Centre (SOC) activities, whether internally delivered or outsourced.
• Monitor security alerts, incidents, vulnerabilities, and threats.
• Ensure effective incident detection, triage, investigation, containment, and recovery.
• Lead cyber incident response activities and coordinate post-incident reviews.
• Ensure cybersecurity monitoring and logging capabilities are maintained and optimized.

Governance, risk and compliance

• Support the implementation and maintenance of the cybersecurity governance framework.
• Manage cybersecurity risk assessments and risk treatment activities.
• Maintain the cybersecurity risk register and track remediation actions.
• Ensure compliance with applicable cybersecurity standards, regulatory requirements, and corporate policies.
• Support internal and external cybersecurity audits.

Security architecture and controls

• Ensure security controls are implemented and maintained across infrastructure, endpoints, cloud services, applications, and OT environments.
• Review and approve security designs for new projects and technology implementations.
• Support secure network segmentation and defense-in-depth strategies.
• Oversee vulnerability management and remediation programs.

Identity and access management

• Ensure privileged access management and identity governance controls are implemented and monitored.
• Oversee periodic access reviews and segregation of duties assessments.
• Support implementation of role-based access control (RBAC) frameworks.
• Ensure compliance with least-privilege principles and account management standards.

Vulnerability management

• Direct vulnerability assessment and scanning activities.
• Prioritize remediation activities based on business risk.
• Monitor closure of identified vulnerabilities.
• Provide reporting on remediation status and risk exposure.

Third-party security

• Assess cybersecurity risks associated with suppliers and vendors.
• Participate in vendor security reviews and due diligence assessments.
• Ensure cybersecurity requirements are incorporated into contracts and procurement processes.

Business continuity and resilience

• Support disaster recovery and business continuity planning.
• Participate in cyber resilience exercises and simulations.
• Ensure cybersecurity recovery requirements are incorporated into continuity plans.

Security awareness

• Develop and maintain cybersecurity awareness and training programs.
• Promote security best practices across all levels of the organization.
• Coordinate phishing simulation and awareness campaigns.

Reporting and performance management

• Prepare cybersecurity dashboards and reports for management.
• Provide regular updates to the Cybersecurity Manager on security posture, incidents, risks, and initiatives.
• Track cybersecurity KPIs and KRIs.
• Monitor progress against the cybersecurity roadmap.

Key deliverables

• Cybersecurity risk register
• Security incident reports
• Vulnerability management reports
• Compliance and audit reports
• Cybersecurity KPI/KRI dashboard
• Security awareness program
• Security standards and procedures
• Incident response plans
• Privileged access reviews
• Third-party security assessments
• Cybersecurity roadmap progress reporting

Required qualifications

Essential

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related discipline.
• Minimum 8-10 years of cybersecurity experience.
• Minimum 3-5 years of cybersecurity leadership or management experience.
• Experience across security operations, risk management, governance, and security architecture.
• Experience managing third-party cybersecurity service providers.

Preferred certifications

• CISSP
• CISM
• CRISC
• GSEC
• GIAC certifications
• ISO 27001 Lead Implementer or Lead Auditor
• IEC 62443 Cybersecurity certifications
• Microsoft Security certifications
• CCSP

Knowledge and experience

Technical knowledge

• Security operations and incident response
• SIEM and security monitoring platforms
• Endpoint detection and response (EDR/XDR)
• Microsoft security technologies
• Identity and access management
• Privileged access management
• Vulnerability management
• Cloud security (Azure/AWS)
• Network security
• OT/ICS cybersecurity
• Security architecture principles

Governance knowledge

• NIST Cybersecurity Framework
• NIST SP 800-53
• NIST Incident Response Framework
• IEC 62443
• ISO 27001
• CIS Critical Security Controls
• Risk management frameworks

Key competencies

• Leadership and team management
• Strategic thinking
• Risk-based decision making
• Communication and stakeholder management
• Incident management
• Problem solving
• Vendor management
• Project management
• Analytical thinking
• Report writing and executive presentation skills

Authority levels

The Head of Cybersecurity is authorized to:

• Direct cybersecurity operational activities.
• Lead cybersecurity incident response activities.
• Escalate significant cyber risks to the Cybersecurity Manager.
• Recommend security control implementations.
• Initiate emergency security containment actions during cybersecurity incidents.
• Review and approve cybersecurity operational standards and procedures.

Key performance indicators (KPIs)

• Mean time to detect (MTTD)
• Mean time to respond (MTTR)
• Vulnerability remediation compliance rate
• Security awareness completion rate
• Audit finding closure rate
• Privileged access review completion rate
• Security incident reduction trends
• Cybersecurity roadmap delivery performance
• Third-party security assessment completion rate
• Compliance with security standards and policies