Information Security Risk Officer | Hybrid | Sri Lanka

Full Job Description

Make your mark in the world of global technology.

• 2-5 years of experience in IT audit, IT Governance/Risk/Compliance, data privacy, or information security management
  
• Excellent written and oral communication skills, as this role involves client-facing responsibilities
  
• Proficient knowledge of ISO 27001, PCI-DSS, SOC 2 Security, and Data Privacy Laws, such as EU-GDPR and PH-DPA
  
• Strong familiarity with and experience in managing endpoint and network security controls, including Windows GPOs, VPN, DLP, RMM, Anti-Malware, and NGFW
  
• Proficiency in creating risk-control matrices (RCM) and security risk reports
  
• Strong project management and interpersonal skills
  

• Client-Facing & Client-Level Security Risk Management
  
• Participation in the launch of new campaigns with new or existing clients, gathering necessary security requirements for the creation of client risk profiles, and implementation of commensurate security controls
  
• Facilitation of control activity tests with test users before full security control implementations
  
• Maintenance of risk registers and security information inventory for each of Emapta’s clients
  
• Presentation of value-adding security recommendations to clients
  
• Involvement in addressing existing and prospective client security concerns or responding to their written questionnaires
  
• Compliance with Security Certifications (e.g., ISO 27001, SOC-2, PCI-DSS)
  
• Conducting Gap Analyses and Internal Audits in alignment with security standards, regulations, and frameworks (e.g., ISO 27001, SOC-2, PCI-DSS)
  
• Collaboration with Process Owners and provision of recommendations
  
• Close monitoring of identified security and compliance gaps and continuous follow-up for remediation actions and artifacts
  
• Creation and maintenance of policies
  
• Development of new security policies (if needed to remediate gaps)
  
• Periodic review of policies to align with changes in security processes or to update security policies in response to emerging critical risks
  
• Ensuring policy alignment with the requirements of standards and regulations that Emapta aims to comply with
  
• Third-Party Risk Management
  
• Assessment of security risks posed by current and prospective vendors/partners and the technologies to be acquired
  
• Maintenance of security risk profiles of vendors
  
• Security Awareness and Education
  
• Collaboration with HR and Learning & Development Teams for the mandatory annual completion of the Information Security and Data Privacy Course by everyone in Emapta, including contractors with access to Emapta’s private information
  
• Launch of Awareness Programs, Phishing Exercises, Security Reminders, and Secure Channels for reporting incidents of fraud, security breaches, or noncompliance with policies
  

• Competitive Package
  
• Medical Life Insurance
  
• Hyrbid work arrangement
  
• Semi-flexible shift
  
• Standard government and Emapta benefits
  
• Well-equipped, modern, and accessible offices
  
• Fun engagement activities for employees
  
• Mentorship and exposure to global leaders and teams