- Operate ISO 27001 and ISO 42001 management systems through evidence collection, risk management, control testing, audits, management reviews, and corrective actions.
- Build and run security operations, including logging, detection engineering, alert triage, incident response, investigations, exercises, and post-incident improvement.
- Own security policies, standards, risk acceptance, vulnerability governance, leadership reporting, security awareness, and the function's maturity roadmap.
- Lead identity, access, vendor, and data-protection controls, including privileged-access governance, reviews, third-party assessments, and data classification and retention.
- Review application and cloud architecture, application code, infrastructure-as-code, IAM policies, CI/CD workflows, and material vulnerabilities with engineering owners.
- Establish security and governance controls for AI systems, including inventories, impact assessments, access boundaries, audit trails, and tested shutdown mechanisms.
PythonTerraform