This role will design Storyblok’s information security strategy and lead all compliance and audit processes. Conducting a regular risk and vulnerability assessment to identify areas for improvement is part of the job. The information security manager will also plan steps to mitigate the identified risks. The person will lead the incident response process for security breaches and coordinate relevant teams. The role will collaborate with different functions and is responsible for training, supporting and coordinating different team members.

ESSENTIAL JOB FUNCTIONS

1. Design the information security strategy, document it, and enable the team:
• Design a strategy and a road map for Storyblok’s information security management system.
• Develop, implement, and maintain information security policies, guidelines, documentation, and processes.
• Align security policies with Storyblok’s goals and regulatory requirements.
• Manage the roll-out of information security changes and ensure policies are communicated and enforced throughout the company.
• Enable and train the team on security-related topics.
2. Risk Management:
• Conduct regular risk and vulnerability assessments together with our risk management team.
• Identify any vulnerable areas within the company by testing and assessments.
• Develop and implement risk mitigation strategies for identified security threats.
3. Incident Response:
• Lead the incident response process for security breaches and coordinate the process with all relevant teams.
• Develop and maintain an incident response plan.
• Coordinate with relevant teams to investigate and respond to security incidents.
4. Compliance and Audit:
• Ensure compliance with relevant laws, regulations, and certification standards (e.g., GDPR, ISO, Fedramp, Privacy Acts).
• Prepare and manage security audits - ISO, Fedramp - to keep or receive certificates.
• Implement corrective actions and strategies based on audit findings.
• Stay updated on the latest security trends, technologies, and standard updates.
5. Technical Security Measures:
• Oversee the implementation and maintenance of security technologies or tools.
• Monitor our information security landscape and ensure these systems' secure configuration and management.
• Design automated, scalable, and efficient information security solutions.
6. Management:
• Collaborate with multiple internal teams to improve our information security system.
• Mentor and coordinate team members who are part of our information security processes to complete projects successfully.
• Support other team members with their security questionnaires and vendor process.
• Promote a culture of security awareness within the organization.
• Lead the communication with any external security-relevant parties.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Experience to setup an information security environment in a remote setup.
• Professional certifications such as CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), or equivalent.
• Proven experience in information security management and security standards like ISO/IEC 27001, SOC, NIST, Fedramp.
• Proven track record of at least one information security certification accomplishment (ISO, SOC, Fedramp)
• Work experience in a company that is ISO and Fedramp certified.
• Strong experience with MDM, Authentication Management, Infrastructure and other information security-relevant tools.
• In-depth knowledge of information security frameworks and best practices.
• Strong analytical, problem-solving, and decision-making skills.
• Excellent communication and interpersonal skills.
• Ability to manage multiple projects and priorities in a fast-paced environment.

Preferred Skills

• Experience with Google Workspace
• Experience with security information and event management (SIEM) systems.
• Knowledge of cloud security principles and practices.
• Experience in incident response and digital forensics.
• Understanding of secure software development practices.
• Knowledge update Cybersecurity
• Good GDPR and Privacy skills