Information Security Specialist (GRC + Technical)

Information Security Specialist (GRC + Technical)

IT Park Uzbekistan | Tashkent, Uzbekistan

About the Role

IT Park Uzbekistan is looking for an Information Security Specialist who combines expertise in governance, risk management, and compliance (GRC) with hands-on technical security skills.

In this role, you will contribute to the development and implementation of the organization's information security framework, ensuring the protection of IT infrastructure, effective risk management, and compliance with national legislation and international standards.

This position is ideal for a professional who is comfortable working with both security documentation and technical infrastructure.

Key Responsibilities

Governance, Risk Management & Compliance (GRC)

Develop, maintain, and update information security policies, standards, procedures, and internal regulations.

Conduct information security risk assessments and maintain the risk register and information asset inventory.

Ensure compliance with Uzbekistan's cybersecurity legislation and international standards, including ISO/IEC 27001 and ISO/IEC 27002.

Prepare for internal and external audits and monitor the remediation of identified findings.

Organize information security awareness and training programs for employees.

Technical Information Security

Review and strengthen the security of network and server infrastructure, including firewalls, VLAN segmentation, and access controls.

Manage vulnerability assessment processes, including scanning, risk prioritization, and tracking remediation with IT teams.

Monitor security events using SIEM/EDR solutions and participate in incident response and investigations.

Manage access rights, privileged accounts, and security configurations for Windows/Active Directory and Linux environments.

Coordinate with external information security service providers and review their reports, recommendations, and deliverables.

Requirements

At least 3 years of experience in information security, including both technical security operations and security documentation.

Solid knowledge of information security frameworks and standards, including ISO/IEC 27001, ISO/IEC 27002, NIST CSF, or equivalent.

Hands-on experience with network security technologies, such as Fortinet, Cisco, or similar solutions.

Practical knowledge of Windows/Active Directory and Linux administration and security.

Experience with SIEM, EDR, and vulnerability scanning tools.

Ability to prepare clear and structured technical and regulatory documentation in Uzbek and/or Russian.

Working-level English proficiency sufficient for reading technical documentation and communicating with vendors.

Strong analytical and problem-solving skills, attention to detail, and a high level of responsibility.

Nice to Have

Professional certifications such as ISO 27001 Lead Implementer/Auditor, CISSP, CISM, CompTIA Security+, CEH/OSCP, Fortinet NSE, or CCNA Security.

Previous experience in government institutions, financial services, or telecommunications.

Experience with cloud infrastructure, containerized environments (Kubernetes), and secure DevOps practices.

Working Conditions

Location: Tashkent, Uzbekistan.

Work schedule: 5/2, Monday to Friday, from 9:00 AM to 6:00 PM.

Employment type: Full-time.

Opportunities for professional development in information security.

The opportunity to contribute to the development and protection of IT Park Uzbekistan's IT infrastructure.

Participation in improving the organization's information security processes and practices.