Head of Information Security

Job Summary: 

The head of Information Security will implement and improve an efficient information security program that embeds security throughout all processes and systems. This role will also ensure that operational, legal, regulatory and security risks related to IT are assessed and mitigated in a cost-effective manner in accordance with the business requirements.

Job Expectations:

• Establish and take ownership of a cybersecurity roadmap with a focus on reducing cyber risk.
• Responsible for IT security, cloud infrastructure security, product security, security operations
• Monitor and manage security incidents and breaches, determine forensic root cause and take remedial actions to prevent recurrence.
• Develop and maintain IT Security Policies, taking into account the latest malicious tools, techniques and tactics.
• Provide security consulting to business units, primarily Developers, in the areas of On Premise, Co-Located, Cloud and Hybrid architectures in a Global E-Commerce environment 
• Provide for ongoing Security Reviews designed to evaluate the current environment as well new and emerging features and technologies to improve iHerb’s Security Posture.
• Lead, mentor and manage the security team resources and ensure services are being delivered as planned and expected to the business. 
• Keep abreast of new and emerging security technologies and stay highly adaptable to their potential applicability for iHerb. 
• Facilitate internal and external audit activities for all of IT.
• Liaise with Legal, Compliance and the Business for review of contract Security clauses and Data Privacy initiatives
• Collaborating with all business units to identify potential risks and risk management procedures
• Collaborate with business stakeholders throughout the company to increase awareness of risk management issues.
• Familiarity with common information security management frameworks like ISO/IEC 27001 and NIST

The duties and responsibilities described above may provide only a partial description of this position. This is not an exhaustive list of all aspects of the job.  Other duties and responsibilities not outlined in this document may be added as necessary or desirable, with or without notice.

Knowledge, Skills and Abilities:

   Required:

• Hands on experience in security systems, including firewalls, intrusion detection systems, anti-malware products, authentication systems, log management, content filtering, mobile device security management, DNS, CDN, WAF and related security technologies
• Familiarity with web related technologies (Web applications, Web Services, Service Oriented Architectures) and of network/web related protocols
• Excellent knowledge of current protocols and standards, including Active Directory, Group Policies, Core Switching/Routing, SSL/IPSec, SAN, Virtualization, Business Continuity, Disaster Recovery.
• Possess outgoing, collaborative, team-oriented style and strong interpersonal skills to successfully manage potential conflicts of information security requirements and business goals
• Possess excellent analytical and problem-solving abilities to identify and fix security risks 
• Communicate effectively with all levels of the company tailoring the message appropriately to gain understanding and consensus. 
• Success in managing information security programs and projects.
• Ability to work collaboratively with others to achieve business goals and objectives.

Experience Requirements:

Generally requires A minimum of 9 years’ experience in Information Security and 2+ years’ experience   with cloud computing 

Education Requirements:

Bachelor’s Degree in Information Security, Computer Science, or related field and one or more of these certifications required (CISSP, CISM,CISA)  

Judgment/Reasoning Ability:  

Able to identify, troubleshoot and resolve problems quickly using sound judgment, poise and diplomacy.  Ability to use judgment and reasoning skills, and determine when to escalate issues, as required, in a timely manner.

Physical Demands:  

The physical demands described here are representative of those that must be met by a Team Member to successfully perform the essential functions of this job.  While performing the duties of this job, the Team Member is regularly required to talk and hear. The Team Member is frequently required to sit, walk, climb stairs, use hands and fingers, bend, stoop and reach with hands and arms.  Reaching above shoulder heights, below the waist or lifting as required to file documents or store materials throughout the workday.  The Team Member may occasionally lift or move office products and supplies up to 25 pounds.  Proper lifting techniques required.  Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Work Environment:  

The noise in the work environment is usually moderate.  Other factors are: 

• Hectic, fast-paced with multi-level distractions
• Professional, yet casual work environment
• Office environment
• Ability to work extended hours as required

#LI-JC1