👥 People & Roles — Security Management
Effective security management depends on clearly defined roles with non-overlapping responsibilities. Below are the key personas aligned to ITIL 4's Information Security Management practice.
Core Roles
Chief Information Security Officer (CISO)
- Owns the enterprise security strategy and risk appetite
- Sponsors security policies and budget allocation
- Reports to the Board and/or CIO on security posture
- Escalation point for critical incidents and breaches
Information Security Manager
- Day-to-day ownership of the ISMS (Information Security Management System)
- Manages policy lifecycle: creation, review, retirement
- Coordinates audits (internal and external)
- Interfaces with Change Management to enforce security gates
Security Analyst (L1/L2/L3)
- Monitors SIEM dashboards and alert queues
- Triages security events; escalates true positives
- Conducts threat hunting and forensic analysis (L3)
- Documents findings and produces threat intelligence reports
Risk Manager
- Maintains the Risk Register and risk treatment plans
- Conducts Business Impact Analyses (BIA)
- Tracks residual risk against appetite thresholds
- Presents risk reports to the steering committee
Compliance Officer
- Maps controls to regulatory frameworks (GDPR, ISO 27001, NIS2)
- Coordinates external audits and certification renewals
- Manages Data Protection Impact Assessments (DPIA)
Identity & Access Management (IAM) Specialist
- Owns role-based access control (RBAC) and PAM policies
- Reviews access provisioning/deprovisioning workflows
- Conducts periodic access recertification campaigns
Security Architect
- Designs zero-trust network segmentation and control frameworks
- Reviews architecture proposals for new services
- Defines encryption standards, key management policies
RACI Matrix
| Activity | CISO | ISM | Analyst | Risk Mgr | Compliance |
|---|---|---|---|---|---|
| Define security policy | A | R | C | C | I |
| Risk assessment | A | R | C | R | C |
| Security incident response | A | R | R | I | I |
| Access review & recertification | I | A | R | I | C |
| Audit coordination | I | R | I | C | A |
| Vulnerability scanning | I | A | R | I | I |
| Patch prioritisation | C | A | R | C | I |
| Supplier security assessment | C | R | I | A | C |
R = Responsible · A = Accountable · C = Consulted · I = Informed
Skill Requirements
| Role | Core Skills | Certifications |
|---|---|---|
| CISO | Strategic leadership, risk governance | CISSP, CISM, ISO 27001 Lead Auditor |
| ISM | ISMS management, policy writing | ISO 27001 LA, CISM |
| Security Analyst | SIEM, threat hunting, EDR | CompTIA Security+, CEH, SANS GIAC |
| Risk Manager | Risk frameworks, BIA, quantitative risk | CRISC, ISO 31000 |
| Compliance Officer | Regulatory knowledge, audit prep | CIPP/E, ISO 27001 LA |
| IAM Specialist | Directory services, PAM, SCIM | MCSA, Okta Certified |
Downloadable Resources
| Resource | Format | Download |
|---|---|---|
| RACI Matrix Template | Word | ⬇ Download |
| Risk Register | Excel | ⬇ Download |
← Back to Security Management Overview