We are looking for a Cybersecurity Business Partner. You will become the link between security and business. Your task is to turn information security requirements into understandable and measurable services that do not hinder processes, but protect them.

Responsibilities

• Formulate and manage the information security services portfolio. Perform and calculate service KPIs.

• Interact with business units and the IT Directorate (business partners), manage the expectations of internal clients and business units of the company, and control the observance of SLAs on the part of the Security Directorate.

• Prepare, organize, and control the execution of measures to improve the quality of service delivery. Control the work of the Security Directorate units. Share responsibility for meeting key quality indicators.

• Organize the preparation of reports on the effectiveness of the Security Directorate's work and implemented controls (together with the specialist responsible for data analysis in the methodology and reporting department).

• Perform dispatching of requests and client inquiries to the Security Directorate in ITSM (together with the information security tools operation service). Be responsible for meeting deadlines for response times to inquiries.

• Formulate and approve the IT (IS) service architecture. Prepare the necessary reports, documents, and local regulations.

• Maintain reporting on work performed in the corporate work and task accounting system (the final system is determined by the manager).

• Organize effective information security controls for access management and asset management (in accordance with ITSM notation). Develop and update methods and regulatory documents within the area of responsibility. Be responsible for familiarizing employees, for whom they are intended, with the documents.

• Organize compliance audits of processes within the area of responsibility, ensure the preservation of necessary artifacts, and bear responsibility for their quality and reliability.

• Regularly collect feedback on the quality of information security services provided (NPS). Develop proposals and organize work to increase customer satisfaction. Be responsible for achieving approved indicators.

• Organize and ensure the implementation of tasks to improve the company's cyber defense level within the goals agreed with the manager. Be responsible for achieving goals in accordance with the rules of corporate performance evaluation.

• Propose, develop, and implement effective methods of work for the department in accordance with the tasks set.

• Provide methodological and practical assistance to new employees of the directorate during their onboarding (within the probationary period).

Requirements

• Knowledge of basic information security threats and risks;

• Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).

• Knowledge of cybersecurity and confidentiality principles, as well as organizational requirements (related to confidentiality, integrity, availability, authentication, non-repudiation).

• Knowledge of access management mechanisms for information resources (e.g., access control lists, role-based access control).

• Knowledge of incident response and remediation methodologies.

• Knowledge of basic network security principles, basic system and OS protection methods.

• Knowledge of the main regulatory legal acts of the Russian Federation and the EU in the field of information security (Federal Laws, orders of Regulators, Government decrees, Presidential decrees).

• Basic knowledge of international information security standards (ISO 2700*, SOC2 type2, GDPR).

• Basic knowledge of current information protection tools and methods.

• Understanding of the product/service lifecycle, knowledge of software development methodologies and stages.

• Knowledge of the basics and principles of project management.

• Knowledge of IT (IS) service management principles ITIL/ITSM.

• Knowledge of contract management principles.

• Developed communication skills (business correspondence, presentation, public speaking).

• Skills in working with feedback (collection, analysis, presentation, development of corrective action plans).

• Skills in developing analytical materials (analytical memos, reports, and conclusions).

• Skills in describing, forming, changing, and implementing IT/business processes and information security controls.

Conditions

• Work in an accredited IT company (relevant for all current IT mortgage holders);
• Hybrid work schedule and corporate equipment – work conveniently;
• Voluntary medical insurance, telemedicine, check-ups – after the probationary period;
• Dentistry and maternity care – on preferential terms;
• Accident and illness insurance, as well as special conditions for insuring family members;
• Adaptation program: from the first day of work, you will learn about the company, colleagues, and what is expected of you in the next three months in simple terms;
• Corporate training;
• Free SberPrime subscription and discounts from partners and on Sber group services;
• New Year's gifts for children, corporate events, and support in special life situations;
• Discounts at X-Fit and WorldClass sports clubs.