At HEINEKEN Kraków (Heineken Business Services Poland), our success comes directly from our great people. We are a growing team of business experts in finance, accounting, data and technology, focused on being inclusive, diverse and open to new challenges.
The Cyber Security Officer actionizes the strategic direction, policies and governance designed by Global Information Security (GIS), and manages controls to ensure the effective delivery of a high-quality Information Security service for HEINEKEN.
As a member of the TP&S Hub Information Security team, the Cyber Security Officer will be the subject matter expert for information security, participate in the incident response team in the event of a security breach and act as a main contact for OpCo stakeholders. The role also has joint responsibility for control processes including audit, security, business continuity and regulatory compliance across Digital & Technology.
Your responsibilities would include
- Security Operations: Maintain global security strategies, update OpCo security standards for local legislative requirements, manage local security approvals, support the design of security controls and procedures, and perform risk reviews for new local programs and services.
- Monitor information security and cyber security policy compliance, conduct Security Controls Effectiveness Assessments, maintain supporting evidence and ensure timely closure of audit and internal control issues.
- Develop and manage Information Security action plans, secure management approval and budget, monitor execution and report locally and centrally.
- Analyse derogation requests and communicate with global security operations and risk management teams for approval.
- Drive cyber security incident responses, perform or guide digital investigations, lead critical local IT security incidents and assist with technical audits such as ethical hacking.
- Advise OpCo and TP&S Hub operations teams on security requirements including patching, antivirus and vulnerability management.
- Security Awareness: Drive cyber security awareness training campaigns and manage and train cyber security staff.
- Security Strategy: Identify risks and recommendations, collaborate with global security product teams and develop controls and processes that improve information security.
- Innovation: Drive implementation of global security strategies and standards, participate in peer security forums, benchmark best practices and provide security expertise across technical platforms throughout solution development and operations.
- Operational Technology – Process Control Domain: Coordinate security incident management and control self-assessments, support the review and closure of information security issues, review security deliverables and support communications and rollout of security standards and procedures.
- Collaborate with other Cyber Security Officers and PCD Security Leads to promote standardisation and simplification.
You are a good candidate if you have
- 7+ years of working experience in Cyber Security.
- 5+ years of experience working in agile teams in multicultural environments.
- 5+ years of experience working with senior business stakeholders and OpCos.
- A Bachelor’s or Master’s degree in Information Security or a relevant subject.
- A strong technical background and experience in one or more IT areas.
- Experience with Information and Cyber Security management disciplines.
- Experience with standards such as ISO 27001 and COBIT, and relevant laws and regulations including GDPR.
- Experience managing audit and control processes in a technology context.
- ITIL certification or formal training.
- Ability to work cross-functionally, manage conflicting priorities and deadlines, and operate in a changing matrix environment.
- Strong communication, relationship management, influencing, networking, attention to detail and independent decision-making skills.
- Excellent written and verbal English; other languages are welcome.
Nice to have
Certification in a relevant IT Security discipline, such as CISA, CISM, CISSP or CEH.