网络安全经理
网络安全经理领导组织保护其系统、数据和服务免受网络威胁的工作。他们制定安全政策，管理网络风险，监督安全运营和安全工程，领导对重大网络事件的响应，并营造安全意识文化。在医疗卫生领域，他们确保在发生攻击时临床服务能够继续安全运行并迅速恢复。
本文由人工智能助手从英文翻译而来，尚未经过母语人士审校。引自英国政府数字与数据专业能力框架（UK GDaD PCF）和 ESCO 的内容保留英文原文。
- 职族
- 网络安全
- UK GDaD PCF 角色
- 无：本参考资料定义该角色
- ESCO 职业
- cybersecurity risk manager (ISCO-08 2529); chief ICT security officer (ISCO-08 2529)
级别
| 职级 | 角色级别 | UK GDaD PCF 级别 | 英国公务员职等 | 岗位评估分数 |
|---|---|---|---|---|
| 8a | 网络安全经理 | — | — | 566 |
| 8b | 高级网络安全经理 | — | — | 606 |
| 8c | 网络安全主管 | — | — | 646 |
| 8d | 首席信息安全官 | — | — | 716 |
在数字医疗卫生组织中
- 对医疗卫生组织的网络攻击可能使临床系统停止运行并使患者面临风险，因此网络安全是患者安全和业务连续性的一部分。
- 医疗卫生组织往往必须达到行业网络安全标准，并向相关主管部门报告严重事件。
- 临床人员需要快速访问系统，因此安全政策与临床医生共同设计并经过可用性测试。
- 安全依赖于众多供应商，包括临床系统供应商和共享服务，因此供应商保证是该角色的核心部分。
- 医疗器械和遗留系统带来长期存在的风险，需要与临床工程和临床安全团队一起管理。
ESCO 职业与技能
ESCO 列出了雇主对每种职业通常需要（必备）或可能需要（可选）的技能和知识。可将其用作发展谈话的检查清单。
cybersecurity risk manager
Cybersecurity risk managers identify, analyse, assess, estimate and mitigate cybersecurity-related risks of ICT infrastructures such as systems or services. They manage these aspects by planning risk analysis, applying, reporting, assessing, communicating, and treating them. They establish a risk management strategy for the organisation and ensure that risks remain at an acceptable level for the organisation by selecting mitigation actions and controls.
必备技能和知识（22）
技能与能力
- advice on security risk management
- communicate with stakeholders
- engage with stakeholders
- ensure adherence to organisational ICT standards
- establish an ICT security prevention plan
- establish an Information Security Management System
- implement ICT risk management
- manage system security
知识
- ICT network security risks
- ICT performance analysis methods
- ICT security standards
- assessment of risks and threats
- attack vectors
- cyber attack counter-measures
- cyber security
- ethical hacking principles
- information security strategy
- internal risk management policy
- risk management
- security engineering
- security threats
其他
可选技能和知识（50）
技能与能力
- define security policies
- define technology strategy
- design for organisational complexity
- develop information security strategy
- develop with cloud services
- execute ICT audits
- identify ICT security risks
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- implement spam protection
- lead disaster recovery exercises
- manage disaster recovery plans
- manage keys for data protection
- remove computer virus or malware from a computer
- solve ICT system problems
- use ICT ticketing system
- use an application-specific interface
- use back-up and recovery tools
知识
- ICT encryption
- ICT problem management techniques
- ICT process quality models
- ICT project management
- ICT quality policy
- ICT recovery techniques
- ICT security legislation
- ICT system user requirements
- Internet of Things
- Open source model
- Outsourcing model
- audit techniques
- cloud monitoring and reporting
- cloud security and compliance
- computer forensics
- decision support systems
- domain name service
- hybrid model
- information confidentiality
- internet governance
- investment analysis
- legal requirements of ICT products
- levels of software testing
- mobile device management
- organisational resilience
- service-oriented modelling
- systems development life-cycle
- tools for ICT test automation
- web application security threats
chief ICT security officer
Chief ICT security officers protect company and employee information against unauthorized access. They also define the Information System security policy, manage security deployment across all Information Systems and ensure the provision of information availability.
必备技能和知识（47）
技能与能力
- advice on security risk management
- communicate with stakeholders
- comply with legal regulations
- develop information security strategy
- educate on data confidentiality
- engage with stakeholders
- ensure adherence to organisational ICT standards
- ensure compliance with legal requirements
- ensure cross-department cooperation
- ensure information privacy
- establish an ICT security prevention plan
- establish an Information Security Management System
- forecast organisational risks
- identify ICT security risks
- implement ICT risk management
- implement ICT security policies
- implement corporate governance
- lead disaster recovery exercises
- maintain plan for continuity of operations
- manage IT security compliances
- manage disaster recovery plans
- manage system security
- monitor developments in field of expertise
- monitor technology trends
- utilise decision support system
知识
- ICT network security risks
- ICT process quality models
- ICT project management
- ICT project management methodologies
- ICT security legislation
- ICT security standards
- assessment of risks and threats
- attack vectors
- audit techniques
- cyber attack counter-measures
- cyber security
- data protection
- decision support systems
- ethical hacking principles
- ethics
- information confidentiality
- information security strategy
- internal risk management policy
- organisational resilience
- risk management
- security engineering
其他
可选技能和知识（34）
技能与能力
- apply operations for an ITIL-based environment
- assess ICT knowledge
- conduct impact evaluation of ICT processes on business
- coordinate technological activities
- create solutions to problems
- execute ICT audits
- identify legal requirements
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- manage digital identity
- manage keys for data protection
- manage staff
- optimise choice of ICT solution
- protect personal data and privacy
- train employees
- use different communication channels
知识
- ICT communications protocols
- ICT encryption
- ICT infrastructure
- ICT recovery techniques
- ICT system user requirements
- Internet of Things
- World Wide Web Consortium standards
- cloud monitoring and reporting
- cloud security and compliance
- cloud technologies
- computer forensics
- computer programming
- control objectives for information and related technology
- internet governance
- software anomalies
- web application security threats
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.