Senior Manager ICS Security

JOB DESCRIPTION

JOB TITLE

Lead Security Industrial Control Systems (ICS)

LEVEL & GRADE

(Level to be determined by BIAL)Grade C

DIVISION/ DEPARTMENT

ICT Security & Governance

COST CENTER

73000

REPORTS TO

Jacxine Fernandez

DATE

28Sep2021

1. JOB PURPOSE

As Lead Security ICS for ICT Applications the individual is responsible to ensure thatinformation security its management system and technical security operations for Industrial Control Systems (ICS) and similar Operational Technologies (OT). You will be responsible to keep these maintained according to legal and regulatory requirements as well as in alignment with the leading/ best practicesand ensure high performance high availability and reliability. In this role you will lead and manage security projects related to ICS/SCADA systems while also overseeing daytoday security operations to ensure the continuous protection of BIALs critical infrastructure.

The individual will be working in close coordination with the BIAL ICT leadership and BIALs vendors who provide Security Services/Products for Operational Technologiesto facilitate information security and to assist in providing compliant systems/servicesrelated aspects of BIAL ICS/OT landscape. The individual should have excellent communication skills and must display visible energy and passion for the role and willingness and experience level that will ensure success for the broader BIAL ICT organization.

1. PRINCIPAL ACCOUNTABILITIES

Accountabilities

Major Activities

Security Governance & Leadership in ICS/OT domain

• Develop and implement a comprehensive security strategy for BIALs ICS/SCADA environment aligned with industry best practices and regulatory requirements (e.g. IEC 62443.
• Ensure compliance with relevant legal and regulatory requirements.
• Ensures the confidentiality integrity and availability of ICS/OT systems and related data.
• Define and communicate expectations and procedures for security audit of BIAL ICS/OT landscape.
• Schedule periodic security audits of BIAL ICS/OT landscape
• Collaborate with OT and IT stakeholders to develop and recommend the OT/ICS security architecture and its optimum integration (if needed) with ICT networks ensuring a holistic approach to security at BIAL.
• Develop and maintain documentation of security policies procedures and incident response plans related to ICS/SCADA.
• Review and approve changes in the BIAL ICS/OT security policies procedures and security architecture for BIAL ICS/OT landscape.
• Ensure that security technologies that are protecting ICS/OT assets are managed as per BIAL requirements.
• Advise ICT Governance Risk & Compliance team on how to propagate awareness of BIAL ICS/OT security procedures to BIAL employees and relevant stakeholders.
• Train and coach junior staff in BIAL ICS/OT security policies and procedures.
• Maintain knowledge of the functionality and technology of:
  • o BIAL ICS/OT technologies
  • o General view of the current state of security threats across the ICS/OT environment

Security Operations & Monitoring

• Oversee daytoday security operations including monitoring security alerts incident detection and response and log analysis.
• Operate securely by communicating and enforcing ICS/OT security strategy policies and standards.
• Ensure that all security breaches are monitored and remedial action are taken to prevent reoccurrence of such events in BIAL ICS/OT landscape.
• Ownership of the information security risk management process in BIAL based on OT Security Framework.
• Analyze traditional ICS (PLCs and controllers) and modern OT security implementations (segmentation data aggregation and SOAR) and develop understanding of how these devices communicate.
• Review and approve changes in systems design and integration and network architecture.
• Report on security posture and risk assessments to senior management

New Projects & Continuous Improvement in BIAL ICS/OT Landscape

• Interact with related disciplines through committees to ensure the consistent application of policies and standards across all ICS/OT projects systems and services.
• Lead and manage security projects for ICS/SCADA systems including vulnerability assessments penetration testing and security architecture design.
• Be up to date with changes in regulatory and statutory OT security controls. Provide status updates to BIAL leadership of any open audit and regulatory issues.
• Stay uptodate on the latest ICS/SCADA threats and vulnerabilities and implement mitigation strategies.
• Manage implementation of new security projects enhancements and transformation programs in the relevant ICS/OT systems
• Manage security change deployment in a systematical manner to ensure no negative impact on ICS/OT systems affected by change.
• Identify or develop automated processes to simplify the service which will provide more time for the team to appropriately analyze call out and assist in remediation of critical information security incidents in BIAL ICS/OT domains.

Stakeholder & Financial Management

• Partner with business stakeholders to raise awareness of information security and assist them in identifying critical assets.
• Develop and deliver security awareness training for personnel working with ICS/SCADA systems.
• Communicate and collaborate with business leaders and product owners to understand the security impact of the initiatives.
• Accountable for ensuring that service delivery and performance of vendors providing ICS/OT security services and security products is as per BIAL expectations.
• Participate in ICT leadership in vendor governance reviews and highlight issues to BIAL and Vendor senior management which need resolution

1. DIMENSIONS

Financial

• Provide relevant inputs from ICS/OT security perspective to help Head Security and Governance determine the Annual Budget and periodic forecasting

NonFinancial

• Approximately 10 indirect reports including small and large vendor resources providing ICT/OT security services and security products

1. OPERATING NETWORK

Internal

External

1. 
   
2. JOB SPECIFICATION

1. Education qualification and certifications

1. Bachelor or masters degree preferably in Electronics Computer Science ICS Systems Cyber Security or related domains
2. Preferable to have completed the ICS/CERT ICS Training
3. CISSP/ GICSP/CISM/GRID/CCNAcertification will be nice to have.
4. Awareness of ISO 27001 and NIST (ICS related) framework.
5. Familiarity with relevant security frameworks and standards (e.g. IEC 62443 NIST SP 80082.
6. SANS Global Industrial Cyber Security Professional certification will be nice to have

1. Years of Experience10 years of experience in ICS security systems like PLC SCADA DCS Serialization solutions. Out of these 10 years candidate must have minimum 4 years as Service Delivery in Maintenance and Operations of a large ICS/OT landscape in India or abroad

1. Knowledge and work skills

1. Experience in ICS/OT domains related to Transport Manufacturing FMCG and other such related/ regulated industries is preferable.
2. Experience with ICS Process Control Networks and SCADA is highly desirable.
3. Knowledge of product design of OT/ICS/IoT devices
4. Knowledge of ICSSecurity threat modelling vulnerability assessments and pentesting.
5. Knowledge network architectures network protocols OT Protocol knowledge (Modbus DNP3 Ethernet IP etc. industrial protocols Active Directory Backup processes virtualization of applications
6. Awareness of Firewall and intrusion detection/prevention protocols
7. Awareness of Secure coding practices ethical hacking and threat modeling
8. Working knowledge of relevant IT security controls (e.g. firewalls intrusion detection systems).
9. Knowledge of thirdparty auditing and cloud risk assessment methodologies
10. Awareness of Remote access security techniques and products
11. Proven track record of managing operational KPIs SLAs initiatives risks etc.
12. Experience in driving initiatives centered on continuous improvement innovation and automation.
    1. Positive bias towards excellence and customer centricity
       1. Analytical and problemsolving skills and ability of leadership reporting in clear and concise manner
       2. Excellent written and verbal communication skills and highlevel of personal integrity.
       3. Innovative thinking and leadership with an ability to lead and motivate crossfunctional interdisciplinary teams.
       4. Collaboration and Conflict Management
       5. Risk Assessment and Management

1. Behavioral Competencies

Sl. No

Behavioral Competency

Required Level

1

Strategic Leadership

Proficient Leading self/teams effectively

2

Change Influencer

Advanced Leading Team/ Organization during change

3

Innovation Mindset

Advanced Innovating to impact Team/ Organization performance

4

Customer Centricity

Advanced Driving competitiveness and innovation

5

Excellence

Advanced Driving business performance

6

Collaboration

Advanced Collaborating across businesses

Cost Center Head

Jacxine Fernandez

Date:

Department Head

Jacxine Fernandez

Date:

HR BP

Amit Khanna

Date:

Required Experience:

Senior Manager