サイバーセキュリティマネージャー
サイバーセキュリティマネージャーは、システム、データ、サービスをサイバー脅威から守るための、組織の取り組みを率いる。セキュリティ方針を定め、サイバーリスクを管理し、セキュリティ運用とエンジニアリングを監督し、重大なサイバーインシデントへの対応を主導し、セキュリティを意識した文化を築く。医療では、攻撃が起きたときに、臨床サービスが安全に動き続け、素早く復旧できるようにする。
このテキストは英語から AI アシスタントによって翻訳されたもので、日本語を母語とする方による確認はまだ行われていません。英国政府デジタル・データ専門職能力フレームワーク(UK GDaD PCF)と ESCO からの引用は英語のままです。
- UK GDaD PCF のロール
- なし: このリファレンスがロールを定義しています
- ESCO の職業
- cybersecurity risk manager (ISCO-08 2529); chief ICT security officer (ISCO-08 2529)
レベル
| バンド | ロールのレベル | UK GDaD PCF のレベル | 公務員の等級 | 職務評価ポイント |
|---|---|---|---|---|
| 8a | サイバーセキュリティマネージャー | — | — | 566 |
| 8b | シニア サイバーセキュリティマネージャー | — | — | 606 |
| 8c | サイバーセキュリティ責任者 | — | — | 646 |
| 8d | 最高情報セキュリティ責任者 | — | — | 716 |
デジタルヘルス組織では
- 医療機関へのサイバー攻撃は、臨床システムを止め、患者を危険にさらしうるため、サイバーセキュリティは患者の安全と事業継続の一部である。
- 医療機関は、分野のサイバーセキュリティ標準を満たし、重大なインシデントを関係当局に報告しなければならないことが多い。
- 臨床職員にはシステムへの素早いアクセスが必要なため、セキュリティ方針は臨床医とともに設計され、使いやすさがテストされる。
- セキュリティは、臨床システムの供給者や共有サービスなど、多くの供給者に依存するため、供給者の保証はこのロールの中核的な部分である。
- 医療機器とレガシーシステムは長く続くリスクを生むため、臨床工学チームや臨床安全チームとともに管理される。
ESCO の職業とスキル
ESCO は、各職業について、雇用主が通常必要とする(必須)、または必要とするかもしれない(任意)スキルと知識を列挙しています。育成に関する対話のチェックリストとして使ってください。
cybersecurity risk manager
Cybersecurity risk managers identify, analyse, assess, estimate and mitigate cybersecurity-related risks of ICT infrastructures such as systems or services. They manage these aspects by planning risk analysis, applying, reporting, assessing, communicating, and treating them. They establish a risk management strategy for the organisation and ensure that risks remain at an acceptable level for the organisation by selecting mitigation actions and controls.
必須のスキルと知識(22)
スキルとコンピテンス
- advice on security risk management
- communicate with stakeholders
- engage with stakeholders
- ensure adherence to organisational ICT standards
- establish an ICT security prevention plan
- establish an Information Security Management System
- implement ICT risk management
- manage system security
知識
- ICT network security risks
- ICT performance analysis methods
- ICT security standards
- assessment of risks and threats
- attack vectors
- cyber attack counter-measures
- cyber security
- ethical hacking principles
- information security strategy
- internal risk management policy
- risk management
- security engineering
- security threats
その他
任意のスキルと知識(50)
スキルとコンピテンス
- define security policies
- define technology strategy
- design for organisational complexity
- develop information security strategy
- develop with cloud services
- execute ICT audits
- identify ICT security risks
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- implement spam protection
- lead disaster recovery exercises
- manage disaster recovery plans
- manage keys for data protection
- remove computer virus or malware from a computer
- solve ICT system problems
- use ICT ticketing system
- use an application-specific interface
- use back-up and recovery tools
知識
- ICT encryption
- ICT problem management techniques
- ICT process quality models
- ICT project management
- ICT quality policy
- ICT recovery techniques
- ICT security legislation
- ICT system user requirements
- Internet of Things
- Open source model
- Outsourcing model
- audit techniques
- cloud monitoring and reporting
- cloud security and compliance
- computer forensics
- decision support systems
- domain name service
- hybrid model
- information confidentiality
- internet governance
- investment analysis
- legal requirements of ICT products
- levels of software testing
- mobile device management
- organisational resilience
- service-oriented modelling
- systems development life-cycle
- tools for ICT test automation
- web application security threats
chief ICT security officer
Chief ICT security officers protect company and employee information against unauthorized access. They also define the Information System security policy, manage security deployment across all Information Systems and ensure the provision of information availability.
必須のスキルと知識(47)
スキルとコンピテンス
- advice on security risk management
- communicate with stakeholders
- comply with legal regulations
- develop information security strategy
- educate on data confidentiality
- engage with stakeholders
- ensure adherence to organisational ICT standards
- ensure compliance with legal requirements
- ensure cross-department cooperation
- ensure information privacy
- establish an ICT security prevention plan
- establish an Information Security Management System
- forecast organisational risks
- identify ICT security risks
- implement ICT risk management
- implement ICT security policies
- implement corporate governance
- lead disaster recovery exercises
- maintain plan for continuity of operations
- manage IT security compliances
- manage disaster recovery plans
- manage system security
- monitor developments in field of expertise
- monitor technology trends
- utilise decision support system
知識
- ICT network security risks
- ICT process quality models
- ICT project management
- ICT project management methodologies
- ICT security legislation
- ICT security standards
- assessment of risks and threats
- attack vectors
- audit techniques
- cyber attack counter-measures
- cyber security
- data protection
- decision support systems
- ethical hacking principles
- ethics
- information confidentiality
- information security strategy
- internal risk management policy
- organisational resilience
- risk management
- security engineering
その他
任意のスキルと知識(34)
スキルとコンピテンス
- apply operations for an ITIL-based environment
- assess ICT knowledge
- conduct impact evaluation of ICT processes on business
- coordinate technological activities
- create solutions to problems
- execute ICT audits
- identify legal requirements
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- manage digital identity
- manage keys for data protection
- manage staff
- optimise choice of ICT solution
- protect personal data and privacy
- train employees
- use different communication channels
知識
- ICT communications protocols
- ICT encryption
- ICT infrastructure
- ICT recovery techniques
- ICT system user requirements
- Internet of Things
- World Wide Web Consortium standards
- cloud monitoring and reporting
- cloud security and compliance
- cloud technologies
- computer forensics
- computer programming
- control objectives for information and related technology
- internet governance
- software anomalies
- web application security threats
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.