IT Security Governance Officer

Role purpose

Governance and compliance responsibilities

• Develop, implement, and maintain government-aligned information security policies, standards, and procedures.
• Ensure compliance with national cybersecurity regulations, data protection laws, and government directives.
• Align IT security governance with ISO 27001, NIST, COBIT, and government cybersecurity standards.
• Monitor security-control compliance across government systems and entities.
• Ensure data classification, access control, and information-handling policies are enforced.

Risk, audit, and coordination

• Conduct information security risk assessments and support risk treatment plans.
• Coordinate internal and external audits, regulatory reviews, and compliance assessments.
• Track security risks, exceptions, and remediation actions.
• Support governance aspects of cybersecurity incidents, reporting, and post-incident reviews.
• Review third-party and vendor security compliance for government contracts.
• Support cybersecurity awareness and mandatory government training programs.
• Prepare governance reports, dashboards, and compliance submissions for senior management.
• Collaborate with legal, compliance, IT, and national cybersecurity authorities.

Required qualifications and competencies

• Bachelor’s degree in information security, IT, Computer Science, or a related field.
• Four to seven years of experience in information security governance, risk, or compliance; public-sector experience is preferred.
• Strong knowledge of government cybersecurity governance and regulatory environments.
• Experience with public-sector IT policies and compliance frameworks.
• Skills in risk management, audit coordination, and compliance monitoring.
• Strong documentation, reporting, and policy-writing abilities.
• Ability to communicate security risks in a non-technical, executive-friendly manner.
• High integrity and attention to confidentiality requirements.
• Knowledge of national cybersecurity policies and government data protection laws.

Preferred certifications

• Professional certifications are preferred: CISM, CISSP, ISO 27001 Lead Implementer/Auditor, or CRISC.