The company is heavily R&D driven, and as such, it is critical that intellectual property is duely safeguarded. As an information security manager, you will manage information security risks within the R&D domain, which is a challenging position in an intellectual property-driven enterprise.

Throughout the company multiple disciplines are required to ensure proper identification, mitigation and management of these risks.

R&D Security Risk Management (SRM) operates within the R&D domain, which includes Development & Engineering, System Engineering and all Business Lines. R&D SRM is responsible for keeping information security risks within the R&D risk appetite by identifying and assessing risks, driving risk mitigation and monitoring execution.

R&D Security risk management (SRM) is organized into Focus areas. You will be responsible for the Focus Area ‘Assurance’ where you will manage a small team. Attention areas are Cloud (IaaS/PaaS), Export compliance, anomaly detection and generic compliance to identified risk mitigating controls.

Besides the team management you’ll be expected to perform/assist in information security risk assessments and support the R&D SRM department as a whole.

Key responsibilities:

• Operational management of the ‘Assurance’ function
• Define and implement maturity improvements for the Assurance function
• Define and implement improvements for monitoring of compliance to agreed upon security controls
• Align with other focus area leads on operational management, strategy and execution
• Alignment with risk (action) owners on risk mitigation of identified and agreed upon mitigating controls
• Continuous monitoring of compliance to implemented controls
• Perform information security risk management activities. These activities include the execution of risk assessments, analysis/evaluation of identified risks and proposed mitigating controls.
• Risk control compliance reporting
• Contribute to R&D security risk register maintaining risk control status
• Alignment with other security competences (IT and Business) within the security community
• Contribute to improving risk management means and methods
• Advice and align with the organization on security risk management topics
• Provide and contribute to security awareness trainings for specialized topics within D&E