Manager - Cybersecurity, Application Security

Overview Job Description Job Title Manager Job Code 701431 Grade T1 Group Division Legal, Risk & Governance Department Cybersecurity Unit ROLE PURPOSE The aim is to state the overall significance of the job from the organization's perspective. The role exists to lead cybersecurity governance, risk, compliance, and protection activities across the assigned scope by setting direction, overseeing security controls, enabling regulatory alignment, and driving cybersecurity maturity. The role contributes to protecting Elm's information assets, digital services, and business operations by ensuring cybersecurity practices are implemented, monitored, and continuously improved in alignment with Elm's approved policies, procedures, strategic objectives, and applicable regulatory requirements. Key Accountabilities & Activities This section describes the principal outputs required from the job. Key Accountabilities Key Activities • Cybersecurity Strategy and Governance • Lead the development and execution of cybersecurity plans, initiatives, and governance activities within the assigned scope. • Ensure cybersecurity objectives are aligned with Elm's strategic priorities, business requirements, and regulatory expectations. • Provide direction and guidance on cybersecurity policies, standards, procedures, and control requirements. • Cybersecurity Risk Management • Oversee cybersecurity risk assessments for systems, services, processes, and business initiatives. • Validate key cybersecurity risks, control gaps, threats, and vulnerabilities that may impact confidentiality, integrity, or availability. • Drive risk treatment plans and follow up with stakeholders to ensure timely mitigation and effective risk reduction. • Security Controls and Compliance Oversight • Oversee the design, implementation, and effectiveness of cybersecurity controls across the assigned environment. • Ensure compliance with applicable cybersecurity regulations, internal policies, and relevant standards. • Review compliance gaps, remediation plans, and evidence to support audit readiness and management reporting. • Cybersecurity Advisory and Business Enablement • Provide cybersecurity advisory support to business and technical stakeholders on initiatives, projects, and services. • Ensure cybersecurity requirements are embedded into solutions, processes, and business decisions from early stages. • Balance business enablement with risk-based cybersecurity controls and practical implementation guidance. • Security Monitoring and Incident Response Oversight • Oversee cybersecurity monitoring activities and ensure security events are reviewed, escalated, and handled appropriately. • Coordinate with relevant teams during cybersecurity incidents to support investigation, containment, remediation, and reporting. • Review incident outcomes and ensure lessons learned are translated into improvement actions. • Vulnerability and Threat Management • Oversee vulnerability management activities, including prioritization, remediation follow-up, and risk-based treatment. • Monitor emerging cybersecurity threats and assess their potential impact on Elm's systems, services, and operations. • Coordinate with system owners and technical teams to ensure timely closure of critical vulnerabilities and exposure areas. • Stakeholder Management and Cybersecurity Awareness • Build and maintain effective relationships with internal stakeholders, business owners, technology teams, and governance functions. • Promote cybersecurity awareness and support the adoption of secure practices across the assigned scope. • Facilitate alignment between cybersecurity requirements, business priorities, and operational delivery needs. • Performance Reporting and Continuous Improvement • Prepare and review cybersecurity dashboards and management updates covering risks, controls, compliance, incidents, and improvement plans. • Analyze cybersecurity performance indicators to identify trends, gaps, and maturity improvement opportunities. • Lead continuous improvement initiatives that enhance cybersecurity resilience, governance effectiveness, and operational readiness. • Policies, Processes & Procedures • Follow all relevant departmental policies, processes, standard operating procedures, and instructions so that work is carried out in a controlled and consistent manner. • Comply with all relevant safety, quality, and environmental management policies, procedures, and controls to ensure a healthy and safe work environment. • Information Security • Comply with all relevant information security practices and standards to ensure data integrity and confidentiality. JOB SPECIFICATIONS Academic And Professional Qualifications • Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Computer Engineering, or a related field. • Master's degree in a relevant field is preferred. • Professional certifications in cybersecurity, information security, risk management, governance, or related fields are preferred. Years And Nature Of Experience • 8+ years of relevant experience in cybersecurity, information security, governance, risk and compliance, security operations, vulnerability management, or a related field. • Experience in leading cybersecurity activities, overseeing security controls, managing cybersecurity risks, supporting regulatory compliance, coordinating stakeholders, and driving cybersecurity maturity improvement initiatives. Show more Show less

Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Computer Engineering, or a related field. Master's degree in a relevant field is preferred. Professional certifications in cybersecurity, information security, risk management, governance, or related fields are preferred. 8+ years of relevant experience in cybersecurity, information security, governance, risk and compliance, security operations, vulnerability management, or a related field. Experience in leading cybersecurity activities, overseeing security controls, managing cybersecurity risks, supporting regulatory compliance, coordinating stakeholders, and driving cybersecurity maturity improvement initiatives.

Lead cybersecurity governance and risk activities; oversee risk assessments; design, implement, and ensure effectiveness of cybersecurity controls; ensure compliance with regulations and internal policies; provide cybersecurity advisory to business and technical stakeholders; oversee security monitoring, incident response, and coordination during cybersecurity incidents; manage vulnerability and threat management; build stakeholder relationships; promote cybersecurity awareness; prepare cybersecurity dashboards and drive continuous improvement; ensure policies, processes, and procedures are followed; maintain information security practices and standards.