Senior Cyber Security Consultant | Information Security & IT-Risk Manager

IT-Risk Management (50%): IT-Risk Assessment, risk items tracking and control, manual correlation and pre-processing of large-scale data sources, building risk reports to the CRO. IT-Security Management (50%): Advisory 1st Line of Defense, improvement of pro-active and repressive security procedures, supporting the security officers in the daily business.

IT-Security Consulting / Security Maturity Assessment (100%): Expert for ISO 27001:27002, planning security assessment according to control objective definition (ISO 27001 Maturity Level), security audit and GAP analysis of requirements against controls, implementation of security policies and ISMS processes, focus on ISMS-Framework Plan-Do-Check-Act (PDCA), functional leadership in Access Control and Communication Management.

Pre-Sales (50%): Product prospect presentation, Proof of Concept demonstration (PoC), 3rd Party vendor interoperability checks, on-site workshops for CyberArk Software Ltd products including Privileged Identity Mgmt. Suite, Privileged Session Manager, Application Identity Manager and Privileged Threat Analysis. IT-Security (50%): Identity Lifecycle Analysis (ILM) and role conception, network security-class analysis and component zone conception, firewall rule-set definition, component resource planning, system hardening and prerequisites definition, test environment setup and use-case definition, integration of customers IAM, PKI, SIEM and big-data logging facilities.

Information Security (40%): ISMS-Framework and ID-Governance conception, Data Classification and data protection (DLP), awareness strategies, Business Continuity Management (BCM) and Identity and Access Management (IAM) solution design, IT-Risk management framework design according to IRAM (ISF), support for ISO27001 certification. IT-Risk (40%): Gap-Analysis (on-boarding/change of object/off-boarding), assessment of 3rd Party suppliers (Privileged Access, Data-Protection, Compliancy, Loss-of-Staff), Risk-Reporting to C-Level management, on-site services. IT-Security (20%): Security incident administration, security policy controlling, awareness campaign programs, on-site services.

Information Security / IT-Governance (20%): Security policy and control objective definition, achievement of objects according to regulatory standards and requirements (Basel III, ISO27001:27002). IT-Risk Management (20%): Building the Risk-Landscape report, reporting to C-Level management. IT-Security Lead (60%): Solution Design and Implementation of PKI, HSM, Web-Application infrastructure (3-Teer, Reverse Proxy, Web-Services), BCM for PKI and HSM systems, staging and integration procedures for PKI and WAF systems. Awareness campaign programs, hardening guides, baselines for developers, administrators and end-users. Source-Code Review (J2EE) for security framework assessments. Policy compliance assessments on DLP, ILM, IAM. Firewall rule-set assessments. Penetration Testing including web-application manual hacking and coordination with external penetration testers.