Information Security Lead

pbLocation: /b Any MSF office within +/-3 hours CET /p pbContract: /b Fixed term at 100% position - The term of this assignment is intended to be for a period of two (2) years, nevertheless, the duration of the contract may be subject to the employment regulations and labor laws of the country where the selected candidate is based. /p pbStarting date: /b 15th of November 2026 /p pbDeadline to apply: /b 18th of October 2026 /p pbCompensation and Benefits: /b MSF practice is to offer the compensation and benefits package in line with the MSF entity offering the contract. /p h3I. MSF INTERNATIONAL /h3 pMédecins Sans Frontières (MSF) is an international, independent, medical humanitarian organisation that delivers emergency aid to people affected by armed conflict, epidemics, healthcare exclusion and natural disasters. MSF offers assistance to people based only on need and irrespective of origins, religion, gender or political affiliation. MSF International provides coordination, information and support to the MSF Movement, as well as implements international projects/programmes and initiatives as requested. /p h3II. POSITION BACKGROUND /h3 pThe Information Systems Management (ISM), one of the international platforms of MSF gathering all the Heads of IT/IS from key MSF entities, has been mandated by MSF’s executive governance body, the Full Excom, to lead the development of an international information systems management strategy seeking to optimise interoperability across MSF in priority areas. The ISM Platform is responsible for setting standards for IT/IS architecture and technology development and aims to promote targeted innovation in information technology/information systems (IT/IS). /p pCritical to this role, and in response to an increasingly complex cyber and global regulatory landscape, the ISM Platform spearheaded the development of a global information security policy framework back in 2020, which has continued to evolve. /p pIn its strategic ambitions, the ISM Platform has committed to prioritising information security and incident resilience as a cross-cutting theme across all its initiatives. The role of the Information Security Lead is to develop an effective execution strategy and a programme to improve MSF’s overall information security posture and governance of information security in the movement. /p h3III. PLACE IN THE ORGANISATION /h3 pThe Information Security Lead will: /p ul lipReport hierarchically to the International Information Systems Coordinator (who chairs the ISM Platform), with functional oversight provided by the ISM Platform /p /li lipWork closely with the members of the ISM Platform, InfoSec focal points in each section, ISM InfoSec WG, MSF SITS (Shared IT Services) and other MSF stakeholders to ensure the information security initiatives, working group(s) and/or task force(s) created/sponsored/guided by the ISM are all aligned to the evolving needs of the organisation and the ISM’s strategic vision /p /li lipWork in collaboration with the ISM Coordination team to ensure a consistent approach to programme and project management within the ISM portfolio and Working Group (WG) initiatives /p /li /ul h3IV. OBJECTIVES OF THE POSITION /h3 pThe Information Security Lead will lead the development of the roadmap for information security governance, risk compliance in MSF under the guidance of the ISM platform and in close collaboration with the Info Sec WG. The Information Security Lead will provide strategic guidance, operational support, and incident response expertise across headquarters and field missions, balancing security requirements with the realities of medical and humanitarian operations. /p pThe Information Security Lead will establish the governance mechanisms necessary to ensure better identification, monitoring and mitigation of information security risks in MSF. This role will recommend planning and allocation of infosec resources, and develop the necessary processes/frameworks to do so. /p pSpecific Objectives /p ol lipAn effective global information security framework, strategy, and roadmap are in place to guide MSF’s short-, medium-, and long-term security priorities. /p /li lipPriority information security risks are proactively managed through a shared and structured organisational approach. /p /li lipSecurity incidents requiring intersectional coordination are responded to effectively, limiting impact and supporting resilience. /p /li lipTechnical information security decisions across MSF are informed by reliable expert guidance. /p /li lipSensitive information is managed securely and in line with relevant governance requirements. /p /li lipOrganisational information security awareness and capability are strengthened on an ongoing basis. /p /li lipEmerging threats and external developments relevant to MSF are monitored and reflected in a stronger overall security posture. /p /li /ol h3V. KEY RESPONSIBILITIES /h3 pInformation Security Strategy and Governance /p ul lipDevelop, implement, and maintain MSF’s information security strategy and roadmap /p /li lipDefine and maintain information security policies, standards, and procedures /p /li lipAdvise senior management on information security risks and mitigation options, including new resourcing and delivery models /p /li lipSupport definition of mutualised approaches for selected information security capabilities across MSF (e.g. baseline policies/standards, security monitoring / SIEM‑SOC options, incident coordination, third‑party security assurance, etc.) /p /li lipContribute to organisational risk management and governance processes /p /li /ul pRisk Management /p ul lipIdentify, assess, and prioritise information security risks in the movement /p /li lipConduct and support information security risk assessments for existing and new initiatives /p /li lipPropose feasible mitigation measures /p /li lipSupport the documentation and acceptance of residual risks /p /li /ul pIncident Response and Crisis Management /p ul lipLead responses to movement‑wide information security incidents /p /li lipSupport field missions and headquarters during high‑pressure or sensitive incidents /p /li lipCoordinate with relevant functions (IT, legal, communications, HR, security, etc.) /p /li lipEnsure post‑incident reviews and follow‑up actions are completed /p /li /ul pTechnical and Operational Security Oversight /p ul lipAdvise on matters such as infrastructure, network, cloud, and endpoint security /p /li lipAdvise on security matters such as identity access management and remote working /p /li lipEnsure security requirements are integrated into system design, procurement, and third‑party arrangements /p /li /ul pData Protection, Ethics, and Safeguarding /p ul lipAdvise on data classification, minimisation, retention, and secure sharing /p /li lipWork closely with data protection, legal, safeguarding, and other stakeholders /p /li lipPromote digital practices that minimise risks of harm to individuals and communities /p /li /ul pAwareness and Capacity Building /p ul lipDevelop and deliver information security awareness and training programs /p /li lipBuild information security capacity among staff /p /li lipTranslate complex security concepts into clear, practical guidance /p /li /ul pCoordination and Representation /p ul lipCollaborate closely with all relevant functions /p /li lipChair the ISM Information Security Working Group sessions /p /li lipCoordinate with external service providers and security experts /p /li lipRepresent MSF in relevant information security and humanitarian forums /p /li lipMonitor emerging threats relevant to humanitarian and medical organisations /p /li /ul h3Education: /h3 ul lipMinimum Bachelor's degree in a technical discipline (Computer Science, Cybersecurity, Information Technology, etc.) or equivalent /p /li lipCertification as a security professional, e.g. Certified Information Systems Security Professional (CISSP) or Certified Information Security Auditor (CISA) /p /li /ul h3Experience and skills: /h3 ul lipMinimum 7 years’ experience in information security or security risk management. /p /li lipStrong expertise in cloud, network, and cybersecurity, including incident response, vulnerability management, DLP, IDS/IPS, and penetration testing. /p /li lipGood knowledge of security frameworks, risk management, and compliance requirements (e.g. NIST, ISO 27001, CIS, GDPR, PCI DSS). /p /li lipExperience developing security policies, standards, and enterprise solutions in complex, decentralised, and international environments. /p /li lipKnowledge of business continuity and disaster recovery. /p /li lipStrong leadership, communication, analytical, and cross‑cultural collaboration skills, with high ethical standards and alignment with MSF values. /p /li /ul h3Languages: /h3 ul lipFluent spoken and written English /p /li /ul h3Other: /h3 ul lipInternational travel may be required a few times a year /p /li lipOccasional availability outside normal working hours during incidents /p /li /ul pbOnly shortlisted candidates will be contacted. /b /p pbAt MSF, we are committed to an inclusive culture that encourages and supports the diverse voices of our employees. We welcome applications from individuals of all genders, ages, sexual orientations, nationalities, races, religions, beliefs, ability status, and all other diversity characteristics. /b /p pbMSF is committed to preventing abuse, inappropriate behaviour, lack of integrity and financial misconduct in its work and care spaces. MSF expects all staff to share this commitment and promote an environment where abuse and misconduct is not tolerated. /b /p pbWe are committed to removing barriers for people with specific accessibility needs. If you need an adjustment to the recruitment process to be considered for the role, please let us know from the beginning of the selection process. /b /p pbNote: All offers of employment will be subject to reference checks and to appropriate screening checks. By submitting an application, the job applicant confirms his/her/their understanding of these recruitment procedures. /b /p #J-18808-Ljbffr