علي الصيود

1. Application security assessment.
a) Determining information security team engagement level.
b) Creating application security requirements.
c) Threat modeling the application, identifying potential risk and advising on security controls to mitigate the risk.
d) Penetration testing the application to identify the vulnerabilities
e) Deduce residual risk based on the pen test and advice on the risk action.
f) Enforce other Information security units engagement in the project such as access management and monitoring units.
 
2. Third Party security assessment.
a) Determining information security team engagement level.
b) Review the security of the third party and assessing the potential risk.
c) Advising security controls to mitigate the risk.
d) Deduce residual risk and advice on risk action.
 
3. Infrastructure security assessment:
a) Discovering infrastructure security weaknesses.
b) Recommending a safeguard security control.
c) Coordinating the security control implementation.
 
4. Reviewing and assessing information security exceptions and requests.
a) Refer the exception or request to its policy and standard.
b) Review it against the policy and standard.
c) Recommend none violating solution if possible.
d) If no alternatives are available then I decide on the necessary action such as dispensation or rising risk acceptance.  

5. Coordinating new information security projects.
 
6. Monitoring network configuration changes.
 
7. Monitoring firewall and IDS traffic.
 
8. SARIE second security officer.