Duties/Responsibilities:

• Support the ongoing development, implementation, and continuous improvement of cybersecurity policies, standards, and procedures
• Maintain and enhance the Cyber Incident Response Plan, including playbooks, testing, and post-incident reviews
• Monitor and assess the organization’s security posture, identifying risks and recommending pragmatic mitigation actions
• Enforce and promote least-privilege access controls and strong identity and access management practices
• Conduct regular access reviews, risk assessments, and vulnerability management, ensuring timely remediation
• Collaborate with IT, engineering, and business teams to ensure security controls are effective, proportionate, and aligned to business needs
• Provide clear, risk-based recommendations with options and trade-offs to support decision-making
• Support the delivery of security awareness and training programs across the organization
• Assist with security monitoring, incident detection, and investigation, coordinating with internal teams and third-party providers as needed
• Contribute to compliance and audit activities, aligned with relevant standards or frameworks where required 
• Support the assessment and ongoing management of third-party and supplier security risks 
• Help embed secure practices into projects, system changes, and operational processes (secure-by-design approach) 
• Support alignment with business continuity and disaster recovery planning to strengthen organizational resilience 
• Define and track cybersecurity metrics and KPIs to measure and report on risk and control effectiveness 
• Support the identification and maintenance of an accurate inventory of systems, assets, and data requiring protection 
• Support the management and documentation of security exceptions and risk acceptances in line with governance processes 
• Participate in regular governance and risk review processes to ensure visibility and alignment on cybersecurity priorities 
• Maintain clear and up-to-date documentation of security controls, processes, and procedures 
• Prepare and deliver reports and presentations on cybersecurity risks, posture, and initiatives to both technical and non-technical stakeholders.
• Escalate significant risks, incidents, or control gaps in line with established governance

• Strong working knowledge of core cybersecurity principles, including access control, risk management, vulnerability management, and incident response
• Experience implementing and maintaining practical, risk-based security controls in a business environment
• Solid understanding of identity and access management, including least-privilege principles and access governance
• Ability to identify, assess, and clearly articulate cybersecurity risks, with pragmatic recommendation.
• Experience supporting or contributing to security policies, standards, and compliance frameworks (e.g., ISO 27001, NIST, CIS or similar)
• Familiarity with security monitoring and incident investigation processes, including coordination with internal teams or third-party providers
• Understanding of third-party and supplier risk management practices
• Ability to support security in projects and operational changes, applying secure-by-design principles
• Strong analytical and problem-solving skills, with the ability to prioritize effectively in a fast-paced environment
• Excellent communication and presentation skills, with the ability to engage both technical and non-technical stakeholders
• Ability to work independently while collaborating effectively within established governance and team structures

Education & Experience:

• Bachelor’s degree in Information Technology, Computer Science, or a related field (or Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field (or equivalent practical experience)
• Proven experience in a cybersecurity, information security, or IT security role, with increasing levels of responsibility
•  Experience working in environments requiring a pragmatic, risk-based approach to security rather than purely theoretical or compliance-driven models
• Demonstrated experience supporting or implementing security controls, policies, and procedures within an organization
• Experience with incident response, risk assessment, and vulnerability management processes
• Exposure to compliance frameworks or standards (e.g., ISO 27001, NIST, CIS or similar)
• Experience working collaboratively with IT, engineering, and business stakeholders to implement security improvements
• Proven ability to communicate cybersecurity concepts clearly to both technical and non-technical audiences
• Experience working with or alongside third-party vendors or service providers in a security context is desirable
• Relevant industry certifications (e.g., CISSP, CISM, or similar) are desirable but not essential