Information and Cyber Security Officer (ICSO)

Key Responsibilities

Reporting to the Head of IT, the Information & Cyber Security Officer (ICSO) leads the cybersecurity program, security operations, and cyber resilience initiatives. The role is responsible for cybersecurity governance, threat monitoring, incident response, vulnerability management, data loss prevention (DLP), identity and access management, and the implementation of security technologies and projects.

The ICSO assesses and mitigates cybersecurity risks, develops key security metrics and reporting, and ensures compliance with company policies, regulatory requirements, and industry best practices. The position also oversees cyber recovery, disaster recovery, business continuity testing, and third-party security risk management to strengthen the overall security posture.

Flexibility is required, as the role may involve on-call support and response to cybersecurity incidents outside normal business hours.

• Lead and manage the organization's cybersecurity program, including security strategy, governance, policies, standards, and risk management practices.
• Monitor, investigate, and coordinate response and recovery activities for cybersecurity incidents, threats, and security events.
• Own and manage the Vulnerability Management Program, including vulnerability assessments, penetration testing, remediation tracking, risk prioritization, and reporting.
• Lead the Data Loss Prevention (DLP) and Information Protection Program, including data classification, monitoring, incident investigation, and protection of sensitive information.
• Oversee Security Operations, including SIEM monitoring, threat detection, endpoint security, security alerts, and incident response activities.
• Manage Identity and Access Management (IAM) controls, including privileged access management, periodic access reviews, and authentication security.
• Establish and maintain secure configuration baselines, system hardening standards, and cybersecurity controls across servers, endpoints, networks, cloud platforms, and business applications.
• Conduct cybersecurity risk assessments and maintain the cybersecurity risk register, ensuring timely mitigation of identified risks.
• Oversee third-party and vendor cybersecurity risk assessments and ensure compliance with company security requirements.
• Support cloud security governance and security controls for Microsoft 365, Azure, and other cloud-based services.
• Manage cyber resilience, business continuity, and disaster recovery planning for cyberattack scenarios, including tabletop exercises and recovery testing.
• Collaborate with Head Office and business stakeholders to ensure alignment with global cybersecurity policies, regulatory requirements, and industry best practices.
• Provide cybersecurity guidance, awareness training, and technical leadership to IT staff and business users.
• Support security audits, regulatory examinations, and compliance initiatives, including adherence to frameworks such as NIST, CIS Controls, ISO 27001, and other applicable standards.
• Prepare and present cybersecurity metrics, risk assessments, vulnerability status reports, incident summaries, and program updates to management, Head of IT, and Head Office timely.
• Maintain the cybersecurity risk register and manage security exceptions, risk acceptance requests, and mitigation plans with business stakeholders.

Qualifications

• Strong experience in cybersecurity operations, incident response, vulnerability management, DLP, IAM, cloud security, and risk management.
• Knowledge of cybersecurity frameworks and standards, including NIST, CIS Controls, ISO 27001, and related regulatory requirements.
• Excellent analytical, problem-solving, communication, and stakeholder management skills.
• Proven ability to manage sensitive situations and protect confidential information.

Requirements

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related field.
• 4-7 years of experience in cybersecurity, information security, or related IT roles, including experience in security operations, incident response, vulnerability management, risk management, or compliance.
• Equivalent combinations of education, professional certifications, training, and relevant hands-on experience will be considered.
• Relevant industry certifications such as CISSP, CISM, CEH, Security , GIAC, Microsoft Security, Azure Security, or similar credentials are highly desirable.

Pay: $90,000.00 - $115,000.00 per year

Benefits:

• 401(k)
• 401(k) matching
• Dental insurance
• Employee assistance program
• Employee discount
• Flexible spending account
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Professional development assistance
• Referral program
• Tuition reimbursement
• Vision insurance

People with a criminal record are encouraged to apply

Education:

• Bachelor's (Required)

Experience:

• Cybersecurity or IT Related: 4 years (Required)

License/Certification:

• CISSP, CISM, CEH, Security , GIAC (Preferred)
• Microsoft Security, Azure Security (Preferred)

Ability to Commute:

• New York, NY 10019 (Required)

Work Location: In person

Salary : $90,000 - $115,000