Information Security Awareness Lead

Overview and Key Duties

The role involves managing the comprehensive security awareness training program for the organisation, including mandatory quarterly modules for all employees. You will own the security awareness roadmap and the annual campaign calendar, addressing essential risks and compliance demands. Coverage extends across various divisions and regions with coordination of local deliveries and site visits.

Program Management

• Administer the Proofpoint Security Awareness Platform by managing training modules, phishing simulations, and generating reports and metrics.
• Collaborate with HRIS teams for the delivery of quarterly and on-demand security training via Workday.
• Respond promptly to reports of phishing emails through PhishAlarm, ensuring proper follow-up and user feedback.
• Conduct monthly induction security awareness sessions for new employees.
• Organise recurring webinars, lunch-and-learn events, and other briefings both in-person and virtually.
• Identify, implement, and conduct role-specific training for specialized functions such as IT, Finance, HR, and other high-risk positions to highlight relevant threats.
• Design and introduce innovative awareness activities like competitions, quizzes, and games to boost engagement and effectiveness.

Phishing and Risk Assessment

• Manage the phishing simulation program consisting of regular tests and results analysis.
• Provide targeted training for users with repeated failures and escalate risky behaviour to management following established protocols.
• Collaborate with Security Operations and Incident Response teams to incorporate actual attack tactics into training simulations.
• Implement access restrictions for individuals exhibiting persistent risky behaviours.

Physical and Behavioral Security Auditing

• Conduct physical security tests such as USB drop exercises to evaluate user responses.
• Perform clean desk audits and check for unattended workstation locking across various offices.
• Utilise audit data to guide targeted awareness campaigns and program enhancements.

Awareness Communication and Campaigns

• Oversee the Cybersecurity Intranet, regularly publishing updates and security guidance.
• Create, procure, and distribute both physical and digital awareness materials including posters, stickers, and digital signage.
• Lead ongoing themed security awareness campaigns, utilizing various communication channels.
• Coordinate the annual Security Awareness Month each October, managing campaign planning, training, quizzes, games, and engagement tracking.

Metrics, Evaluation, and Continuous Improvement

• Generate consistent reports on training completion, program reach, phishing simulation outcomes, and user engagement levels.
• Monitor and report on key performance indicators for program success.
• Conduct user surveys to gather feedback and assess the awareness maturity of the organisation.
• Integrate feedback and data from surveys and incidents to continuously enhance the awareness program.

Collaboration and Stakeholder Interaction

• Partner closely with IT and Security Operations teams to maximize security awareness messaging through system notifications, pop-ups, desktop backgrounds, and banners.
• Coordinate with divisional IT and communications teams to customize and localize awareness content delivery.
• Conduct site visits across divisions and regions to distribute educational materials and facilitate workshops.

Essential Qualifications and Experience

• At least 5 years of professional experience in IT, Information Security, learning development, or a related discipline.
• Demonstrated expertise in executing security awareness, training, or behavioural risk management programs.
• In-depth knowledge of phishing, social engineering threats, and human-centric cybersecurity risks.
• Experience with security awareness platforms and learning management tools.
• Excellent communication and presentation abilities with capability to engage technical and non-technical audiences effectively.

Equal Opportunity Employer Statement

The employer practices equal opportunity employment and encourages applications from all qualified individuals without discrimination.