About the role
Responsibilities:
- Maintain and continuously improve the compliance control set, the supporting evidence and the documentation required by regulatory and audit obligations (GDPR, NIS2 SAP security audits, SWIFT and GITC), covering:
- Application change management and software development life cycle controls.
- Security hardening and vulnerability patching of operating systems and databases.
- IT user access permissions and periodic user access reviews.
- General user access security audit logs, monitoring evidence and review.
- Privileged user access (ie Firefighter usage) and privileged activity review.
- Governance and review of operating systems and databases privileged access, password policies, and baseline identity controls (SSO/MFA principles).
- Software compliance and security web vulnerability management.
- SWIFT Customer Security Programme (CSP) compliance.
- Run the day-to-day operation of the global security awareness programme: plan and launch phishing simulations and training campaigns, follow up on completion, and report on results.
- Track training completion and phishing click/report rates, and propose improvements to campaign content, targeting and follow-up.
- Collaborate with the SAP Basis Security and Authorisation team to review and report SoD violations.
- Coordinate the global vulnerability management process: consolidate scan results, prioritise by risk, track remediation with infrastructure, application and OT owners, and escalate overdue or high-risk items.
- Prepare the monthly, quarterly and annual compliance, vulnerability and awareness reports for the Global Security and Compliance Manager and for Carmeuse IT leadership.
Requirements:
- Bachelor's degree in engineering/technology in Information Security, Computer Science, IT or a related field.
- At least 8 years of experience in IT or cyber security, with hands-on exposure to compliance, audit support and reporting (a GRC or internal audit background is an advantage).
- Working knowledge of regulatory and audit frameworks (GDPR, NIS2 SAP security audits, SWIFT, GITC).
- Mandatory certification: CISA.
- ISO 27001 or CIPM are a plus.
- Language: English (written and spoken).