Head of Information Security

• Team Leadership & Management: Organize and manage the operations of the Information Security Department, establishing KPIs, delegating operational workflows, and monitoring task execution.
• Policy & Governance: Develop, implement, and enforce compliance with enterprise information security policies, procedures, and governance frameworks.
• Asset & Data Protection: Ensure the continuous protection of the company's information assets, IT/cloud infrastructure, and confidential data.
• Access Control & Technical Security: Oversee secure administration of information systems, Identity & Access Management (IAM), and the deployment of network/endpoint security controls.
• Vulnerability Management & Incident Response: Drive vulnerability identification, threat hunting, risk remediation, and lead security incident investigations and post-mortems.
• Regulatory & Legal Compliance: Ensure full compliance with the legislation of the Republic of Uzbekistan 
• IT Controls & SOX: Organize internal IT General Controls (ITGC) and maintain strict compliance with Sarbanes-Oxley (SOX) requirements.
• Audits & Action Plans: Coordinate internal and external security audits, managing remediation workflows and corrective action plans (CAPs).
• Change Management & Third-Party Risk: Oversee the security of IT changes, secure system implementations, and manage third-party vendor risk assessments (TPRM).
• Reporting & Awareness: Deliver executive reports and metrics to senior management and drive continuous security awareness training programs across the organization.

Governance, Risk & Compliance (GRC) Frameworks:

• ISO/IEC 27001 Standard: In-depth understanding of ISO 27001:2022 implementation, Information Security Management Systems (ISMS) maintenance, risk assessment methodologies, and Annex A controls.
• NIST Cybersecurity Framework (CSF): Solid grasp of NIST CSF core functions (Govern, Identify, Protect, Detect, Respond, Recover) and applying NIST standards (such as SP 800-53 or SP 800-82) to corporate security baselines.
• Regulatory & Audit Readiness: Deep knowledge of the legal and regulatory framework of the Republic of Uzbekistan regarding cybersecurity, combined with practical experience in SOX compliance and audit facilitation.

Technical Architecture & Operations:

• Privileged Access Management (PAM): Practical understanding of PAM architecture, credential vaulting, session recording/monitoring, and Least Privilege enforcement for administrative access.
• Multi-Factor Authentication (MFA): Deep experience with enterprise MFA implementations, adaptive/risk-based authentication, FIDO2/hardware keys, and Identity Provider (IdP) integrations.
• SOAR & SOC Automation: Strong functional grasp of Security Orchestration, Automation, and Response (SOAR) concepts, automated playbooks, and integration with SIEM/EDR ecosystems.
• AI in Cybersecurity: Strong interest and proactive approach toward evaluating and adopting Artificial Intelligence (AI) and Machine Learning (ML) solutions within security operations (e.g., AI-assisted SOC workflows, automated threat analysis, and GRC policy mapping).

Leadership & Operational Experience:

• Proven track record in structuring and managing a dedicated Information Security team within a enterprise/corporate environment.
• Hands-on experience in protecting enterprise IT infrastructures, databases, and critical data assets.
• Demonstrated experience overseeing IT change controls, application security, and third-party vendor risk management.
  
  Strong executive reporting, risk communication, and leadership capabilities.

5/2 work schedule – office-based.
Formal employment in accordance with applicable labor legislation.
Voluntary medical insurance or a subscription to Chekhov Fitness Club.
27 calendar days of paid annual leave.
Opportunities for employee learning and development.
Corporate mobile phone service.