The Information Security Specialist at Ruya is responsible for the comprehensive design, implementation, and maintenance of the organization's security framework. This role ensures robust Identity and Access Management (IAM) by strictly adhering to the principle of least privilege, while also overseeing continuous security operations, including 24/7 monitoring, SIEM utilization, and managing the full lifecycle of security incidents. The specialist is also critical in proactive threat and vulnerability management, coordinating assessments and remediation efforts. Furthermore, a key responsibility of the role is to develop, implement, and regularly test the organization's Business Continuity Management (BCM) and IT Disaster Recovery (IT DR) plans, ensuring operational resilience and compliance against an evolving threat landscape.
Key responsibilities:
Identity & Access Management (IAM)
- Develop, implement, and manage IAM strategies, policies, and solutions (e.g., RBAC, SSO, MFA, PAM) aligned with business and regulatory requirements.
- Oversee the full user lifecycle, onboarding, modifications, and de-provisioning of access for employees, contractors, and third parties.
- Conduct regular access reviews, identity attestation, and segregation of duties (SoD) analysis to ensure least privilege and regulatory compliance.
- Manage and optimize IAM platforms (e.g., Okta, SailPoint, CyberArk, Azure AD), including integration with new/existing applications.
- Lead and support IAM audits, compliance initiatives, and incident investigations related to unauthorized access
Security Testing & UAT
- Lead or support security testing activities, including application security reviews, penetration tests, and red team exercises.
- Ensure User Acceptance Testing (UAT) includes security and privacy test cases.
- Obtain formal approval from Information Security prior to product releases or major changes.
Operations / BCM /DR
- Proactively monitor security information and event management (SIEM) systems, log data, and other threat intelligence sources to detect, analyze, and respond to security incidents.
- Provide training and awareness on secure access practices, phishing, and password management.
- Plan, coordinate, and execute regular BCM/DR tests and exercises (e.g., tabletop walkthroughs, functional simulations) to validate the effectiveness of the plans and train response teams.
Mentor business staff and contribute to the continuous improvement of security operations
Collaboration & Training
- Work closely with IT, HR, compliance, and other business units to align access and security controls with organizational needs.
- Provide training and awareness on secure access practices, phishing, and password management.
- Mentor business staff and contribute to the continuous improvement of security operations.
Key Performance Indicators
- Ensure secure, efficient, and compliant access to all bank systems and data.
- Minimize risk of unauthorized access, data breaches, and cyber incidents.
- Maintain compliance with regulatory and audit requirements.
- Continuously improve access management and security engineering practices.
