First-Line Security Planning and Accountability
- Formulate and execute the ICT security work plan for our managed systems in alignment with approved cybersecurity strategy, policies, standards and risk appetite.
- Maintain clear first-line accountability for the security design, implementation and operation of controls within the our managed systems portfolio.
- Translate policy requirements into actionable control plans, operating procedures, technical baselines and delivery priorities for our managed systems.
- Secure and deploy the resources, capabilities and services required to achieve agreed security outcomes for the portfolio.
- Report the portfolio’s operational security performance, material exposures and delivery constraints to management and the second-line cybersecurity risk function.
Operational Cyber Risk and Control Management
- Identify, assess, document and manage cybersecurity risks arising from systems, projects, operations, changes and related third-party services.
- Own and maintain first-line risk and control registers for the portfolio, including emerging risks, control deficiencies, findings and treatment plans.
- Implement and monitor preventive, detective, corrective and recovery controls for systems in accordance with approved requirements.
- Evaluate policy deviations affecting the portfolio, determine residual risk and mitigating measures, and prepare submissions for the appropriate system owner, risk owner and governance forum.
- Drive remediation of vulnerabilities, audit findings, security review findings and control weaknesses within agreed timelines.
- Collate accurate portfolio security metrics and evidence, review control performance regularly, and escalate risks that exceed approved tolerance or cannot be treated within plan.
Security Engineering, Delivery and Control Implementation
- Embed security-by-design and privacy-by-design controls into projects, procurements, changes and technology lifecycles for systems.
- Translate approved security requirements into solution designs, technical controls, configuration standards and operational acceptance criteria for the portfolio.
- Ensure project and operations teams conduct required risk assessments, architecture reviews, vulnerability assessments, penetration tests, configuration reviews and code assurance activities.
- Review and validate that findings are risk-rated, assigned, remediated or mitigated before go-live and throughout each system’s lifecycle.
- Implement and maintain controls for identity and access management, privileged access, encryption, logging, patching, endpoint protection, data loss prevention, backup and secure configuration within the portfolio.
- Maintain implementation evidence and support technical verification by the second-line cybersecurity function.