The Information Security Officer is responsible for implementing, executing, monitoring, and continuously improving the logical security controls applicable to manufacturing and card personalization activities, in alignment with PCI Card Production Logical Security, customer requirements, and Thales CDI Information Security policies. The role protects production operations, personalization data, cryptographic assets, systems, networks, and supporting processes by ensuring that security controls are documented, implemented, monitored, evidenced, and maintained in an audit-ready condition. The position also supports risk identification, risk treatment, security procedure development, incident escalation, access governance, change control, secure configuration, vulnerability and patch follow-up, and compliance readiness for internal and external audits.

Main Responsibilities:

• Maintain the Information Security Management System updated and aligned with the evolution of Iztapalapa manufacturing and personalization activities, DIS Information Security Policy, PCI-CP Logical Security and applicable customer requirements.

• Identify, assess, document, and monitor security and operational risks impacting logical security, production systems, customer data, and personalization operations.

• Maintain certification readiness for PCI-CP, EMVCo + CC, customer audits, and internal security assessments. Coordinate evidence preparation, local team readiness, procedure updates, control walkthroughs, and remediation follow-up to ensure the site supports certification activities effectively and autonomously.

• Ensure findings from: internal, customer, certification, and compliance audits are reviewed, assigned, prioritized, and closed according to severity and committed deadlines. Validate action plans, track progress, document delays, maintain evidence, and escalate overdue or high-risk items.

• Coordinate and support internal control reviews to verify that logical security controls are implemented, operating effectively, and evidenced. Use SCART and internal audit results to detect gaps early, define sustainable corrective actions, validate closure evidence, and prevent recurrence.

• Monitor vulnerability identification, prioritization, remediation, exception handling, and compensating controls for assets supporting manufacturing and personalization operations. Ensure serious and high vulnerabilities are treated within defined timelines or covered by documented risk-based waivers and approved compensating measures.

• Coordinate the annual penetration test ensuring that all in-scope systems, applications, network segments, infrastructure components, and personalization environments are tested. Ensure penetration test findings affecting production systems, network segmentation, applications, infrastructure, and personalization environments are assigned, risk-rated, remediated, retested, or formally accepted through approved exception processes.

• Ensure firewall configurations are regularly reviewed, optimized, and documented. Identify unused, obsolete, redundant, shadow, unknown, overly permissive, or unauthorized rules and ensure they are removed, corrected, or justified through approved local policy exception or waiver.

• Ensure security incidents are identified, classified, escalated, contained, investigated, and documented according to DIS policy, PCI-CP expectations, and local procedures. Coordinate root cause analysis, corrective actions, lessons learned, and recurrence prevention for incidents impacting operations, systems, data, cryptographic material, or customer obligations.

• Verify that critical suppliers supporting manufacturing, personalization, IT, infrastructure, logistics, maintenance, or security activities are assessed, monitored, and covered by appropriate contractual security requirements, including data protection, incident notification, audit rights, and confidentiality obligations.

• Ensure that site security and operational personnel understand their information security responsibilities, receive role-based training, and actively contribute to sustaining the Information Security Management System through proactive ownership, risk awareness, and continuous improvement in daily operations.

Minimum Requirements:

Formal Education:

Bachelor’s degree in Information Security, Computer Science, IT, Engineering, or related field

Languages:

Spanish fluent; English intermediate to advanced

IT/Software:

Microsoft 365, ticketing tools, access management tools, SIEM/log review tools, vulnerability & firewall management platforms, evidence repositories

Experience in years:

5 years in information security, IT security, compliance, audit, or secure manufacturing environments

Technical Knowledge:

PCI-CP logical security; risk assessment; access control; network segmentation and firewall governance; vulnerability and patch management; security procedure writing