Job Description
Vacancy for the Post of Director / Chief Information Security Officer – Enterprise Security and Incident Response (01 Position)
Founded in 2006, the Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT) is Sri Lanka's National CERT which has the mandate to protect the nation's cyber space.
Sri Lanka CERT is inviting applications from highly experienced, visionary, and results-oriented cybersecurity professionals to join its team as Director / CISO – Enterprise Security & Incident Response.
This is a strategic leadership opportunity to lead enterprise cybersecurity, incident response, and security operations while contributing to the strengthening of Sri Lanka's national cybersecurity resilience. The successful candidate will play a pivotal role in driving cybersecurity strategy, strengthening organizational security capabilities, and leading initiatives that support one of the nation's premier cybersecurity institutions.
Job Responsibilities
- Strategic Leadership and Governance
- Develop and implement the organization’s cybersecurity strategy, policies, standards, and procedures.
- Provide strategic direction for enterprise security architecture, governance, and risk management initiatives.
- Advise the Board of Directors and senior management on cybersecurity risks, threats, and mitigating strategies.
- Ensure alignment of cybersecurity initiatives with business objectives and national cybersecurity frameworks.
- Lead the development and periodic review of information security policies, guidelines, and standards.
- Enterprise Security Management
- Oversee enterprise-wide security operations, including network security, endpoint security, cloud security, and application security.
- Direct vulnerability assessment and penetration testing activities to identify and mitigate security weaknesses.
- Ensure the implementation and maintenance of security controls, monitoring systems, and security technologies.
- Monitor emerging cyber threats and recommend appropriate defensive measures.
- Lead cybersecurity program improvement initiatives across the organization.
- Incident Response and Cyber Operations
- Lead the organization’s cyber incident response and crisis management functions.
- Ensure effective monitoring, detection, investigation, containment, eradication, and recovery of cybersecurity incidents.
- Oversee Security Operations Center (SOC) activities and cyber threat monitoring operations.
- Coordinate digital forensic investigations and post-incident analysis activities.
- Develop and maintain incident response playbooks, drill and exercise plans.
- Risk Management
- Risk Management and Compliance Conduct enterprise cybersecurity risk assessments and implement mitigations strategies.
- Ensure compliance with applicable cybersecurity laws, regulations, standards, and industry best practices.
- Coordinate internal and external security audits and compliance reviews.
- Monitor third-party and vendor cybersecurity risks.
- Stakeholder Coordination and Reporting
- Liaise with government agencies, regulators, law enforcement authorities, and external cybersecurity stakeholders.
- Prepare and present cybersecurity risk and incident reports to senior management and the Board.
- Represent the organization at national and international cybersecurity forums and engagements.
- Administrative and Managerial Responsibilities
- Lead and manage teams assigned to enterprise security and incident response functions.
- Prepare budgets, procurement plans, and resource allocation for cybersecurity operations.
- Evaluate and recommend cybersecurity technologies, tools, and service providers.
Educational and Professional Qualifications
A Bachelor's Degree (SLQF 5 or 6) in Information Security, Cyber-Security, Computer Science, Information Technology or any other field relevant to the post, obtained from a local or foreign university, recognized by the University Grants Commission (UGC) in Sri Lanka.
And Postgraduate Degree (Master’s) (SLOFF 9 or above) in Computer Science, Information Security, Cyber-security, Information Technology or any other field relevant to the post, obtained from a local or foreign university recognized by the University Grants Commission (UGC) in Sri Lanka or Associate/Fellow Membership of a recognized professional institution in Information Security, Cyber-Security, Computer Science.
And should hold a verifiable Cyber-security Certification, preferably CISSP, CISM, CSSLP, GCIH, or any other security certification relevant to the post, recognized by Sri Lanka CERT.
Experience Requirements
Twelve (12) years or above industry experience in the field of information and Cyber security or relevant out of which 05 years should be held in a Senior Management position of successful policy leadership with evidence of handling strategic and operational issues in application security and incident response services with a reputed private sector cyber-security service provider, public corporation, statutory board, fully government-owned company, or a reputed commercial establishment, after obtaining the first Degree.
Other Skills / Abilities
- Deep understanding of information security standards (ISO, NIST, OWASP, CIS benchmark etc.)
- Deep understanding of application security principles, practices, and frameworks.
- Extensive experience in developing and leading incident response efforts.
- Visionary Leadership: Ability to develop and communicate a clear vision for application security and incident response.
- Collaborative Approach: Strong ability to work collaboratively with various stakeholders and foster teamwork.
- Integrity and Accountability: High ethical standards and a strong sense of accountability for security outcomes.
- Proactive and Innovative: Forward-thinking with the ability to anticipate and address emerging cyber-security threats.
- Proven strategic planning, program management, and team leadership skills.
- Excellent analytical, problem-solving, and decision-making abilities.
- Strong communication and interpersonal skills, with the ability to effectively communicate complex security issues to executive leadership and stakeholders.
- Ability to work under pressure and manage multiple priorities in a fast-paced environment.
Other General Qualifications
Candidates should fulfill the following general requirements:
- Should be a citizen of Sri Lanka.
- Should be physically and mentally fit to discharge the duties of the post well and to serve in any part of the Island.
- Should be of excellent moral character.
- Should have a good command of the English and Sinhala/Tamil language as interactions with high-level national institutions, international agencies and other institutions overseas is a job requirement.
- Age should be not less than 35 years and not more than 55 years.
Salary will be based on current industry standards and includes travel allowances.
If you are confident that you are the ideal candidate for this position, e-mail your resume with a recent photo and two non-related referees to careers@cert.gov.lk with details of this advertisement, stating “Director / CISO – Enterprise Security & Incident Response.” Only shortlisted candidates will be notified.
Note: This job description is not intended to be all-inclusive. Employees may perform other related duties as negotiated to meet the ongoing needs of Sri Lanka CERT.
Chief Executive Officer
Sri Lanka Computer Emergency Readiness Team | Coordination Centre
Room 4-112, BMICH, Bauddhaloka Mawatha, Colombo 00700
Tel: 011 2691692 / 011 2679888