Organizations around the world are beginning to address the human when securing their organization. The days of just compliance focused training are gone, we need to also effectively change behavior. To achieve that, you need the right person in charge. Below is an attempt to describe what the job description of a security awareness officer could look like.
Security Awareness Officer
This individual is overall responsible for our security awareness and education program. Ultimately this person’s job is to reduce risk to our organization by ensuring all employees, staff and contractors know, understand and follow our security requirements and behave in a secure manner.
Our Security Awareness Program Requirements
- Ensure that our security awareness program meets all industry regulations, standards, and compliance requirements.
- Ensure that our security awareness program communicates our security policies and requirements so that people know, understand and can follow them.
- Identify the top human risks to our organization and the behaviors we need to change to mitigate those risks. Develop and maintain a security awareness program that effectively changes these behaviors so our employees act in a secure manner, reducing the most risk to our organization.
- Create a positive program that engages employees, to include focusing on changing behaviors both at home and at work. Ultimately we want our employees to demonstrate the same secure behaviors regardless of where they are or the devices they are using.
- Structure and maintain this program to be long term, so ultimately we are not changing just behaviors but culture.
- Create a metrics framework that can effectively measure these requirements.
Skills and Experience
- Ability to form complex ‘communications / messages’ in a simple, clear and concise manner to the various communities within our organization. This can include different cultures, nationalities, international locations and languages.
- Project management experience, the ability to plan, manage and maintain a complex, organization wide program over the longer term.
- Display practical knowledge of different message distribution techniques to ensure end user communities understand and continually apply the required behavioral change necessary to reduce the ‘human factors’ risk.
- Ability to communicate with and coordinate the activities of others.
- Understanding of the concepts of information risks and the different elements that make up risk. In addition have at a minimum a basic understanding of the different concepts of information security.
After writing this description, I noticed how often the word 'communication' is in the description, far more then the word 'security' is. Perhaps instead of calling it "Security Awareness Officer" we should say "Security Communications Officer". What would you word differently, what do you think is missing or should be changed? Post your feedback in the comments area.