Informasiya təhlükəsizliyi (GRC) üzrə baş mütəxəssis

About the role

The organization is seeking a senior information security professional to lead governance, risk, and compliance (GRC) activities. The role involves shaping the security strategy, ensuring compliance with international standards, and driving risk‑based decision making.

Key responsibilities

• Participate in the development and maintenance of the information security strategy and ensure alignment with standards.
• Analyze information security risks based on ISO 27001, SANS CIS CSC, NIST and agency‑specific policies.
• Oversee cyber governance and risk‑management processes in line with the security strategy.
• Plan and monitor periodic reviews of security controls and processes.
• Manage IT and information‑security risks, support ISO compliance and personal data protection, and collaborate with departments to create policies and action plans.
• Identify, assess, manage, and mitigate risks related to IT infrastructure, software, platforms, and suppliers.
• Validate that new technological solutions comply with security policies, analyse gaps and document findings.
• Develop strategy, objectives and goals for security awareness, training and education programmes.
• Assess and improve the organization’s information‑security maturity level.
• Perform any other related tasks as required.

Required profile

• Bachelor’s degree in IT or information security.
• Minimum 4–5 years of experience in information security.
• Professional certification such as CISSP, CRISC, CISA, CISM, CGRC or equivalent.
• Knowledge and experience in risk assessment and IT audit processes.
• Fluent in Azerbaijani and English (both written and spoken); Russian is a plus.
• Strong analytical thinking.
• Ability to build teamwork and communicate effectively with stakeholders.

Required skills

• ISO 27001
• SANS CIS CSC
• NIST framework
• Risk assessment
• IT audit
• CISSP
• CRISC
• CISA
• CISM
• CGRC