Information Security Officer

About the role

The Information Systems Agency of Armenia supports the creation of an e-society under the leadership of the Government and the Central Bank of Armenia, following the Digital Architecture of Armenia. As Information Security Officer, you will own and continuously improve the agency's security governance, risk management and security assurance activities, including an information security management system (ISMS), incident preparedness and response, and partnerships with delivery teams so that security enables progress.

Key responsibilities

• Define and maintain the information security strategy, priorities and multi-year roadmap aligned with the Digital Architecture of Armenia and national cybersecurity goals.
• Establish, implement and improve an ISMS aligned with ISO/IEC 27001, including policies, procedures, risk treatment plans and assurance evidence.
• Lead security risk management: maintain an enterprise risk register, run risk assessments and drive risk-based remediation with accountable owners.
• Set security architecture principles and review major designs (identity, interoperability, cloud, infrastructure) for security-by-design and privacy-by-design.
• Oversee vulnerability management, secure configuration baselines and security monitoring with the SOC and engineering teams.
• Ensure effective incident management (plans, playbooks, exercises, reporting) and coordinate with AM-CERT during incidents requiring national-level response.
• Plan and lead internal and external security assessments and audits, track remediation and report to executives.
• Build a security culture through awareness, training and guidance, and mentor cybersecurity staff, including hiring plans and professional development.

Required profile

• 7+ years of progressive experience in information security, cybersecurity governance or security engineering, including leading programs or teams.
• Hands-on experience implementing and operating an ISMS (ISO/IEC 27001 or equivalent).
• Preferred: experience with national-scale digital services, critical infrastructure, regulated or public sector programs; incident response coordination with SOC/CERT teams; third-party and supply chain security risk management; privacy and data protection requirements.
• Professional working proficiency in both Armenian and English.
• Certifications such as CISSP, CISM, CRISC, CISA, ISO/IEC 27001 Lead Implementer/Auditor or cloud security certifications are valued but not required.

To apply, send your CV by email to the agency's HR department, mentioning the position name in the subject line.