Our company is looking for an experienced specialist for the position of Head of Cybersecurity Department. As part of this project, the successful candidate will be responsible for developing and implementing cybersecurity strategies and policies for Sber's subsidiary "Puls". Employment will be with the subsidiary "Puls".
Responsibilities
- Ensuring the protection of the subsidiary's infrastructure, data, and automated systems
- Development of a comprehensive management system and ensuring the subsidiary's cybersecurity function, managing the subsidiary's activities in the field of cybersecurity
- Implementation of the subsidiary's cybersecurity policy, threat models, development and updating of internal regulatory documents in the cybersecurity area
- Organization and implementation of cybersecurity management processes, including processes for monitoring and responding to cybersecurity incidents, cybersecurity risk management
- Identification of threats and assessment of cybersecurity risks for the subsidiary's information infrastructure systems and components
- Enhancing cybersecurity awareness among the subsidiary's employees
- Implementation and support of information security tools (DLP, AV, VPN, SIEM, WAF, etc.)
- Ensuring cybersecurity at the stages of software development, implementation, and operation lifecycle in the subsidiary
- Implementation and development of secure software development processes in the department in accordance with best global practices (FSTEC, NIST, OWASP, Mitre ATT&CK)
- Operation of secure development tools (OSA, SAST, DAST, SCA, etc.)
- Conducting investigations of cybersecurity incidents, eliminating their consequences, developing corrective measures
- Organization and conducting audits and cybersecurity assessments
- Organization and responsibility for ensuring cybersecurity when accessing automated systems, services, IT assets of the department, including remote access.
Requirements
- Higher education in cybersecurity or IT
- At least 10 years of experience in cybersecurity, at least 4 years of experience as CISO
- Knowledge and experience in applying Russian and international cybersecurity standards and requirements of regulatory organizations in information protection (149-FZ, 152-FZ, 98-FZ, 63-FZ, 187-FZ, RD and subordinate acts, ISO, NIST, CIS Controls)
- Knowledge and experience in applying IT standards (TOGAF, ITSM, Cobit, etc.)
- Skills in developing cybersecurity regulatory documentation, preparing reports;
- Knowledge of global practices and frameworks (BSIMM, SAMM, etc.). Understanding and practical experience in secure software development (SSDLC), use of OWASP
- Knowledge of DevOps culture basics, CI/CDL/CDP, agile development methodology
- Understanding of the methodology for forming cybersecurity requirements during software design and development in terms of security
- Understanding of the principles of operation of web applications, microservice architecture, containerized applications, and their protection approaches;
- Experience with information security tools (AV, VPN, SIEM, WAF, etc.), secure development tools (SAST, OSA/SCA, DAST, etc.), endpoint detection and response tools (EDR)
- Understanding of the principles of authentication and authorization systems;
- Understanding of network infrastructure principles;
- Understanding of the principles of operation and organization of operating systems, networks, databases, and ensuring the security of data storage, processing, and transmission;
- Incident investigation skills.
Conditions
- Innovative, ambitious projects and tasks that foster development: there is always an opportunity to enhance your skills and grow professionally;
- An environment for knowledge sharing – high expertise within the team;
- A cohesive team working on common goals and knowing how to relax well;
- Our culture is created by employees themselves – we listen to them and help create and support corporate communities based on interests.
- Stable salary;
- Five minutes from "Kutuzovskaya" metro station, with a fitness room;
- Over 400 educational programs from SberUniversity for professional and career development;
- Extended voluntary medical insurance, preferential insurance for family, and a corporate pension program;
- Flexible discount on mortgage loans, equal to 1/3 of the Central Bank's key rate;
- "Prime" subscription with the ability to use three close...
