Manager IT Product Engineering Security

Philip Morris International; Albarraque; Presencial; EUR 60 000 - 90 000; Tempo integral

Resumo da oferta

Philip Morris International is seeking an experienced Information Security professional in Lisbon, Portugal to act as a single point of contact for information security and risk management across projects and BAU. You will support embedded device cybersecurity, drive security-by-design practices, and oversee vendor risk governance.

Ideal candidates have 5–8 years in information security within a large organization, strong communication skills, and hands-on Agile/DevOps experience, with knowledge

Qualificações

• Minimum 5-8 years of experience in information security, IT risk management or IT audit within a large organization.
• Proven track record in supporting development teams across secure systems development lifecycle.
• Good knowledge of application design patterns (web, mobile, APIs).
• Understanding cloud architectures (SaaS, IaaS, PaaS, FaaS) and security implications.
• Familiarity with IoT, ML and automation; IAM concepts and standards (SAML, OAuth 2.0, OpenID).
• Experience with OWASP Top 10 and regulatory requirements (GDPR/Data Act).
• Experience with electronics manufacturing and supply chain service providers.
• Strong communication; experience in Agile/DevOps; ability to work跨文化团队.

Responsabilidades

• Act as SPOC for information security to implement risk reduction activities with projects and BAU.
• Engage with R&D stakeholders on IS requirements and advice.
• Support cybersecurity for embedded devices across design, development and manufacturing lifecycle.
• Lead security-by-design and privacy-by-design across system lifecycles.
• Govern key security metrics and conduct software security assessments and approvals.
• Evaluate new technologies for security implications (AI/ML/IoT).
• Perform IT control activities including vendor risk governance and third-party assessments.
• Lead security clauses in contracts aligned with PMI standards and TPISS.
• Monitor contractual security obligations and ensure remediation of findings.
• Participate in security awareness and training; promote webinars and learning.
• Respond to cyber incidents from detection to eradication with central IT and Sec teams.
• Drive security maturity, risk management lifecycle, and disaster recovery activities.

Conhecimentos

InfoSec experience

Secure SDLC

Cloud security

IAM concepts

OWASP knowledge

Regulatory compliance

Electronics supply chain

Agile/DevOps

Cross-cultural teamwork

Descrição da oferta de emprego

Be a part of a revolutionary change - find your future in our future

At PMI, we’ve chosen to do something incredible. We’re transforming our business and building our future with one clear purpose – to deliver a smoke-free future. We're disrupting our company from the inside out. Our transformation is redefining every area of our business. From where and how we make and sell our products, to how we engage our consumers and society.

To support this vision, PMI is evolving into a science and technology-based, consumer-facing, multi-category company, and Information Technology (IT) is a vital partner in helping to lead the way. As we accelerate PMI's vision, we get to dream big, too.

With unique and transformative IT projects matching all levels of skill and ambition, we've taken on the spirit of a start-up, with the freedom to craft and define our digital future, but with the support and scope of a vast global business.

YOUR DAY TO DAY

• Act as SPOC for Information Security to implement, report and follow up on risk reduction activities with projects and BAU; and work together with key stakeholders to oversee security improvement activities.
• Engages with business stakeholders from the R&D function on projects and activities that require Information Security expertise and advice.
• Support cybersecurity requirements for embedded devices across the design, development, and manufacturing lifecycle.
• Engage with business and IT platform peers throughout system lifecycle on "security-by-design" and "privacy-by-design" concepts, methods, and tools.
• Perform active governance on key security metrics for systems under his/her responsibility.
• Conduct software security assessments and approvals.
• Evaluate new technologies (e.g., AI, ML, IoT) for security implications.
• Perform or take accountability for general IT control activities in scope of the solutions, including evaluating 3rd party cyber maturity and performing ongoing vendor risk governance.
• Lead the creation and review of security clauses in contracts, ensuring alignment with PMI security standards and regulatory requirements, incl. TPISS.
• Monitor adherence to contractual security obligations and elevate non-compliance issues.
• Ensure timely remediation of findings from third-party assessments and track progress to closure.
• Take part in security awareness trainings and provide coaching, training, promote webinar attendance, or similar activities to raise the security awareness of the function.
• Actively participate in cyber incidents impacting solutions under his/her responsibility, from identification to eradication, working closely with central/platform IT teams and InfoSec (e.g. SOC and IRM).
• Perform risk assessments and vulnerability management activities for functional support areas. Manage, monitor, and report on the full lifecycle of risk management at the system or platform level, from identification to closure.
• Drives cybersecurity resilience activities in the assigned functional domain (e.g. back-up, restored, Disaster Recovery).
• Drive continuous improvement through security maturity assessments.
• Represent IT during internal or external audits.

Who We’re Looking For

• Minimum 5-8 years of experience in an information security, IT risk management or IT audit function within a large organization.
• Proven track record in supporting development teams throughout all phases of secure systems development life cycle (design, development, maintenance).
• Good knowledge of typical application design patterns (e.g. web, mobile, thick client, APIs, etc.).
• Good understanding of cloud computing architectures (e.g. SaaS, IaaS, PaaS, FaaS) and their corresponding characteristics in terms of information security.
• Good understanding of modern technologies such as IoT, Machine learning, and automation.
• Knowledge of basic identity and access management concepts (e.g. single-sign on, identity federation) and standards (e.g. SAML, OAuth 2.0, OpenID).
• Familiarity with most common web application security issues (e.g. OWASP top 10).
• General understanding of regulatory requirements (e.g. GxP, GDPR/Data Act, Chinese cyber and privacy laws) and their impact on systems.
• Experience working with electronics manufacturing and supply chain service providers.
• Strong communication skills and ability to explain technical topics to non-technical people.
• Practical experience in Agile/DevOps organizations and cultures.
• Teamwork and collaboration across cultures and geographies (Europe and Asia).

Preferred Requirements

• Customer Service culture.
• Basic understanding of consumer electronics and product security operations.
• Experience supporting Product Development/Manufacturing/Testing/Labs environments.

WHY SHOULD YOU JOIN US?

At PMI IT, We Believe Success To Be Fuelled By Our Employees, Depended On Them Coming To Work Every Single Day With a Sense Of Purpose And An Appetite For Challenge. We Are a People First Organisation Committed To Empowering You To Take Risks, Grow And Explore.

Here’s What Sets Us Apart

• We’re redefining the big picture of well-being and personal development. We seek the best professionals but recognize them as parents, caregivers, family, and community members. We look after each other and care for our people, so wherever you join us around the world, we’re committed to providing the type of benefits only a company like PMI can offer
• Being the fastest learning IT organization in the world is core to our culture, so we invest significantly in developing our people. From mentoring to technical certifications, stretch roles, soft skills development, and executive education, we help our people develop the skills they need to do their best work and create their own unique impact.
• At PMI IT, we believe diversity and inclusiveness are essential to every industry. We’re proud that our culture is built upon strong corporate values, a foundation of respect and belonging, and a commitment to diversity and inclusion that welcomes a variety of skill sets, backgrounds, and experiences.
• We see digital technology as disruptive and possibilities as endless. Our teams work with innovative technologies such as Cloud, APIs, IoT and AI, supported by management practices and principles such as Agile, Design Thinking, and Product Management.

Every single IT member is part of our Transformation journey. Join us and pursue your ambitions – our staggering size and scale provide endless opportunities to progress.

Together, let’s deliver a smoke-free future.

Additional Information

• Relocation support is not available for this role.
• Only CVs in English will be considered.

19914