World Bank Group
ITS Risk and Security Advisory unit is in need of a Senior Information Security Architect who is results oriented, multi-disciplined, and experienced in designing and reviewing secured solutions for mission critical business applications hosted either in the Cloud (IaaS, Pass, SaaS), or in a hybrid environment that includes both on-premises data centers and the cloud.
*please apply through the link to World Bank website
The World Bank Group (WBG) has an inspiring mission: to end extreme poverty by 2030, and promote shared prosperity by fostering the income growth of the bottom 40 percent in every country. Established in 1944, the World Bank Group is one of the largest sources of funding and knowledge for development solutions. It is governed by 189 member countries and delivers services out of 120 offices with nearly 16,000 staff globally.
Innovation and partnership bond the five institutions of the World Bank Group (WBG): The International Bank for Reconstruction and Development (IBRD) and the International Development Association (IDA), which together form the World Bank; the International Finance Corporation (IFC); the Multilateral Investment Guarantee Agency (MIGA); and the International Centre for Settlement of Investment Disputes (ICSID). The World Bank Group is one of the world’s largest sources of funding and knowledge for developing countries. It uses financial resources and extensive experience to help our client countries to reduce poverty, increase economic growth, and improve quality of life. To ensure that countries can access the best global expertise and help generate cutting-edge knowledge, the World Bank Group is constantly seeking to improve the way it works. Key priorities include delivering measurable results, promoting openness and transparency in development, and improving access to development information and data.
Within the World Bank Group (WBG), the ITS Risk and Security Advisory unit, reporting to the Chief Information Security Officer (CISO), is responsible for providing leadership in managing the functions and activities of information technology risks, security architecture, and solution accreditation across the WBG, enabling the achievement of WBG’s business objectives. ITSRC enables and facilitates a risk aware culture, ensures that WBG information assets are protected in an effective, efficient, and balanced manner, and that IT security and risk management efforts throughout the WBG are coordinated and aligned to the Bank's business and IT strategy. ITSRC manages WBG’s IT and InfoSec risk management framework and practices, establishes and maintains WBG’s enterprise security architecture (ESA) reference model, performs security architecture review and accreditation of business solutions, advises on risk and security controls related to business engagements that involves WBG information or systems, and ensures that the information risks are identified, assessed, and managed in line with the overall risk management approach and with the established risk appetite and tolerance.
ITSRC is in need of a Senior Information Security Architect who is results oriented, multi-disciplined, and experienced in designing and reviewing secured solutions for mission critical business applications hosted either in the Cloud (IaaS, Pass, SaaS), or in a hybrid environment that includes both on-premises data centers and the cloud. The selected candidate would be expected to work primarily in the following areas:
• Strategic planning and security design for the implementation of both off-the-shelf and custom developed business applications that are deployed in the cloud or hybrid environments.
• Streamlining secured software development in the context of agile or DevSecOps processes for deployment into the cloud.
• Defining security architecture patterns for business applications deployed in the IaaS, PaaS, and hybrid environments.
• Setting security standards and providing guidance for cloud and emerging technologies such as Blockchain, Robotics Process Automation (RPA) and Artifial Intelligence (AI) across the WBG.
1. Master’s degree in Computer Science, Information Systems or a related technical field with a minimum of 8 years of relevant experience. (BS/BA is minimum education requirement with 10 years of relevant experience.)
2. Prefer 15+ years of experience as an Information Security Professional designing secured solutions in an environment comprising of financial and trading systems, and systems handling strictly confidential, personnel and proprietary information, including four years of experience with cloud environments such as AWS, Azure, Office 365, Adobe Cloud, ServiceNow, etc.
3. Demonstrated knowledge and experience of applying advanced modeling techniques in developing security architecture for cloud-based and hybrid business solutions.
4. Advanced experience in identity federation and with multi-factor authentication technologies (includes token, smart card, adaptive and biometric solutions) in a hybrid enterprise environment with SaaS, PaaS, IaaS, serverless, and on-premises IT assets.
5. Demonstrated knowledge and experience of developing Business Risk Models by integrating contextual and conceptual security architecture requirements with logical, physical and component security requirements for business applications and data security needs in a “cloud first” enterprise environment.
6. Demonstrated knowledge in identity and access management (IAM), account provisioning, virtual directory, role-based and attribute-based access control etc., especially in a cloud environment and with Identity-as-a-Service solutions such as Azure AD.
7. Demonstrated knowledge and experience in applying policies and procedure in designing security controls for cloud-based workloads and resources such as virtual machines, services, networking, storage, containers, etc. in an enterprise cloud environment.
8. Experience developing DevSecOps pipelines to facilitate agile application development that targets the cloud deployment environment such as AWS or Azure.
9. Expertise in security technologies, architecture patterns, systems/network designs to facilitate cloud-based solutions that support financial management, e-commerce, collaboration, content management, identity management, and mobility.
10. Knowledge and experience in techniques for data protection, including but not limited to, cryptography, tokenization, data classification and tagging, data loss prevention and digital rights management, especially in the cloud environment.
11. Possession of industry certifications is highly preferred, including, but not limited to, Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Global Information Assurance Certification (GIAC), and AWS Certified Solution Architect.
12. Demonstrated excellent interpersonal skills, including the ability to work independently and effectively in a team/task force as a team member or leader, and with senior staff and managers in the unit and elsewhere in the organization.
The World Bank Group values diversity and encourages all qualified candidates who are nationals of World Bank Group member countries to apply, regardless of gender, gender identity, religion, race, ethnicity, sexual orientation, or disability. Sub-Saharan African nationals, Caribbean nationals, and female candidates are strongly encouraged to apply.
The deadline to apply is January 19th 2018, please apply through the link to World Bank website
- Duties and Accountabilities:
- The primary responsibilities of the Security Architect will include, but are not limited to, a combination of the following:
- • Define and maintain WBG’s enterprise security architecture patterns for business applications running in the cloud or hybrid environments;
- • Work with project and development teams to define information security requirements for new cloud-based solutions that are in line with the enterprise information security architecture patterns;
- • Provide subject matter expertise on WBG enterprise application development/data security initiatives for deployment in the cloud;
- • Coordinate with the WBG’s ITS stakeholders to build information security into the enterprise architecture and institutional initiatives;
- • Work with ITS stakeholders to integrate security into the agile and DevSecOps development process;
- • Assist business units in understanding and complying with the enterprise security architecture; from both business application and process perspectives;
- • Maintain an up-to-date understanding of emerging trends in cloud security architecture; apply new techniques and trends that are in-line with overall information security objectives and risk tolerance of the WBG;
- • Assist in the sharing of knowledge with Management regarding the information security readiness of enterprise cloud initiatives;
- • Interface with other OIS teams including, but not limited to, Certification and Accreditation, Security Engineering, Compliance, and Event Management teams, to gather identified information security risks; develop risk profiles for business applications, and identify areas where existing security architecture requires change or development;
- • Continuously evaluate WBG’s current cloud security posture, and propose mitigation and remediation plans based on emerging threats and latest industry leading practices;
- • Assist in identification and implementation of services, tools and methodologies to improve the overall security posture of WBG’s cloud initiatives in the areas of identity and access management, data segregation and protection, encryption key management, mobile or Web-based access, and cloud incident response.