OQ8 - Expert, Cybersecurity & GRC

oq8.om; Muscat; On-site; OMR 30,760 - 46,140; Full time

Job summary

oq8.om is looking for a Cyber Security Lead to manage and execute cybersecurity programs in Muscat. This position requires a Bachelor’s in a relevant field and a minimum of 10 years' experience in information security within large energy industries. The successful candidate will be responsible for the security of information systems, budget planning, and must possess excellent communication skills in English. Come join a dynamic team focused on digital transformation and ensuring information security.

Qualifications

• Minimum 10 years of relevant experience in information security.
• Certificates CISSP preferred.
• Excellent knowledge of written and spoken English.

Responsibilities

• Lead the maintenance of security of networks and data.
• Conduct Information Security Control assessments.
• Manage cyber security budget planning and monitoring.
• Prepare reports for senior management.

Skills

Information security

Cyber risk controls

Incident response

Penetration testing

Operational technology

Security technologies

Communication skills

Education

Bachelor's of Science in Computer Science, Computer Engineering or Cyber Security

Tools

Firewalls

SIEM

Microsoft 365

Azure

Job description

IDS – Digital Application & Cyber Security

Location: Oman, Muscat

Budget control: *OPEX and/or CAPEX and/or Revenue amount as relevant*

Reporting to: Head, Digital Application & Cybersecurity

Direct reports: 0

Job purpose

Lead the execution of Cybersecurity programs at OQ8, under delegated authority of Manager Outsource Service Management, as owner of Cybersecurity standards & solutions, through: (1) Lead the maintenance of security of networks and data and keep tabs on the systems employed by OQ8, reporting any issue(s) to management, (2) Lead the Cybersecurity Policies and Standards (IT/OT), (2) Support the cyber security management process by assessing the adequacy of risk management, information security and business continuity / disaster recovery controls of the company, and (3) Lead the Cybersecurity Governance; in order to support Information Management & digital Transformation at OQ and PT&C stream to ensure the continuity and efficiency of the business.

The position will act in accordance with the OQ8’s Mission, Vision, Values & Strategies, as well as, policies, guidelines and standards, supported by an IT Technology platform, HSE standards, Omani’s government & other legal justification’s, and best international practices in consonance with national objectives

Main tasks and responsibilities

• Responsible for the assessing and documenting of the company’s compliance and risk posture as they relate to its information assets.
• Conduct and/or participate in Information Security Control assessments
• Author information security specifications. Supports the development and implementation of the system-wide risk management function of the information security program to ensure information security risks are identified, quantified and monitored.
• Internally assess, evaluate and make recommendations to management regarding the adequacy of the security controls for the company's information and technology systems
• Authors or updates GRC Operational Procedures associated with Information Security Assessment support the Operations associated with Information Security Awareness Program
• Supports GRC Privacy assessments responsibilities
• Ensures implementation of risk management processes associated with project or control implementations
• Participate in GRC projects associated with Cyber Security controls or Cyber Security Operations
• Lead the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies and regulations.
• Participate \ develop and implement effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.
• Execute strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors.
• General Risk Management Responsibilities: Has good knowledge of applicable risk management practices required to create a
• Reviews IT risk assessments, analyses the effectiveness of information security control activities, and reports on them with actionable recommendations.
• Provides subject matter expertise in the area of cyber risk controls requirements
• Provides specialist cyber risk expertise to support IT projects and operational teams
• Prepare reports for senior management and external regulatory bodies as appropriate
• Participate as full member of IT emergency response team, on-call as per rotation
• Coordinate and track all information technology and security related audits including scope of audits, units involved, timelines, auditing agencies and outcomes. Work with auditors (state, internal, external) as appropriate to keep audit focus in scope, maintain excellent relationships with audit entities and provide a consistent perspective that continually puts the company in its best light. Provide guidance, evaluation and advocacy on audit responses.
• Provide policies, processes and oversight that defines the structure by which the organization security needs and controls are directed and managed
• Manage the security of industrial control and automation systems devices, processes and events
• Manage the development of cyber security roadmaps and security strategies.
• Define and maintain a framework to enable the entity´s ability to deliver functionality and outcomes continuously when facing a Cyber event
• Monitor and analyze cyber security controls deployed in the IT infrastructure, and proactively forecast and respond to impending Cyber threats or attacks
• Manage cyber security budget planning and monitoring.
• Business continuity and disaster recovery planning / implementation.
• Oversee the successful roll-out of cybersecurity projects

Education requirements

Minimum Qualifications for this position is a Bachelor’s of Science degree in Computer Science, Computer Engineering or Cyber Security.

Language

Excellent knowledge of written, read, and spoken English (required)

Background and experience

Competencies and skills

Years of Experience: Minimum 10 years of relevant experience

Certificates CISSP, CISSP preferred

• Relevant experience in a similar role, in large energy industry.
• Experience in information security, specifically with penetration testing, intrusion detection, incident response or digital forensics
• Experience and exposure to operational technology / industrial control systems including SCADA, process control networks, or industrial cybersecurity frameworks.
• Strong IT skills including knowledge on hardware, software, networks, data management and applications.
• Hands-on experience with security with security technologies such as firewalls. EDR/XDR, SIEM, email security, DLP, MFA and privileged access management.
• Familiarity with Microsoft environments such as MS 365, Azure / Entra ID, windows server, active directory and end point security.
• Experience with third-party/vendor security reviews and contract security requirements.
• Experience in Awareness and training programs including phishing simulations and user awareness initiatives.
• Understanding of cyber security process
• Excellent business and technical report writing skills
• Very good knowledge in using PC software.
• Thorough work ethic, attention to detail
• Ability to communicate complex technology solutions to diverse teams namely, technical, business and management teams
• Excellent interpersonal, communication, and presentation skills, including formal report writing experience
• Critical thinking skills, problem solving aptitude