The posting
ITSO – IT Security Officer
Responsibilities and Requirements
· At least 5 years combinedwork experience in software development, application security and cloud computing (e.g. AWS)
· Good understanding of mobile and web application architectures, including APIs and related technologies and protocols suchas REST, SOAP and SSL/TLS.
· Strong knowledge of application securityprinciples and industrybest practices, including the OWASP Top 10 and OWASP Application Security VerificationStandard (ASVS).
· Familiar with Agile development, CI/CD and DevSecOpspractices, including tools such as GitLab,GitHub and Ansible, and the integration of automated security testing intoCI/CD pipelines.
· Experience in using SAST code scanning tools such as Fortify-on-Demand, Sonarqube, etc
· Review system architecture, data flows, interfaces, APIs, internet-facing entry points and securitycontrols to identify potential security risks.
· Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure and cloudservices.
· Preferably possess experience in threat modellingand develop threatprofiles for application projects to identify, quantifyand remediate application security risks.
· Review remediation plans and supporting evidence to verify that securityrisks have been adequately addressed.
· Track and addresssecurity vulnerabilities with timely remediation and patching and closure in accordance with establishedrequirements.
· Monitor and investigate cybersecurity alerts and incidents, includingmalware, phishing, account compromise, data breaches,unauthorised access, and cloud security incidents.
· Perform cybersecurity incident response andmanagement, including incident triage, investigation, containment,remediation, recovery, and post-incident review.
· Conduct security awarenesstraining sessions to promote securityawareness and good cybersecurity practices.
· Good verbal/written communications, collaboration skills and experience interacting with various stakeholders
· Strong analytical, problem-solving and troubleshooting skills, ability to work independently
· Degree in relevantdiscipline, or an equivalent qualification.
· Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS security certification orequivalent are preferred
· Experience in workingwith Government Commercial Cloud (GCC) preferred.



