Princess Cruise Line - Information Security Director

Job Description

The Carnival Corporate Information Security Officer (BISO) serves a pivotal role in safeguarding the information assets and security posture of the assigned brand or business unit. The BISO acts as a strategic partner to both the business and the Office of the Chief Information Security Officer (CISO), ensuring that the brand or unit’s IT activities align with corporate security objectives, industry standards, and regulatory requirements. Key responsibilities include:

• Strategic Security Leadership: The BISO leads the development and implementation of security initiatives specific to the brand, driving security strategy and aligning it with the overarching security vision set by the global CISO. This includes managing security risks, setting priorities, and ensuring that security programs effectively mitigate potential threats while supporting business objectives.

• Compliance and Risk Management: The BISO ensures that all security policies, standards, and practices are adhered to within the brand or business unit. This includes fostering a strong security culture, promoting awareness, and ensuring that security compliance is consistently maintained across all brand-related IT operations. The BISO works closely with legal, risk, and compliance teams to assess and mitigate risks, conduct regular audits, and respond to any gaps in compliance.

• Guidance and Consultation for Brand/Operating Unit IT: As a trusted advisor, the BISO provides guidance on a wide range of security domains, such as access management, data protection, incident response, and security architecture. The role involves ensuring that the IT team has the necessary resources, expertise, and tools to implement effective security controls and meet regulatory and security requirements.

• Brand-Specific Risk Identification and Mitigation: The BISO actively works to identify security risks that are unique to the brand or business unit. This involves a detailed understanding of the brand’s operations, technology stack, and potential threat landscape. The BISO then works to mitigate those risks through targeted initiatives, awareness programs, and collaboration with cross-functional teams, including operations, development, and infrastructure teams.

• Collaboration with Global CISO: Reporting directly to the Global CISO, the BISO ensures that security efforts at the brand level are consistent with corporate security strategies and policies. The BISO provides regular reports to both the Global CISO and the Brand/Operating Unit Executives, highlighting compliance status, identified risks, and ongoing security initiatives. This role is key in facilitating clear communication between the brand and corporate leadership, ensuring transparency in security posture and risk management.

• Incident Response and Crisis Management: The BISO plays an integral role in the event of a security breach or incident, ensuring prompt identification, containment, and resolution of security issues. The BISO coordinates with relevant stakeholders within the brand and across the organization to minimize impact and ensure that proper post-incident analysis and remediation plans are in place.

• Continuous Improvement and Security Maturity: The BISO is committed to the continuous enhancement of the brand’s security posture, driving ongoing security maturity initiatives. This includes staying ahead of emerging threats, adopting best practices, and recommending improvements to existing security frameworks to adapt to the evolving landscape of cyber threats.

In summary, the Carnival BISO is a critical role that bridges the gap between corporate security objectives and the operational realities of the brand, ensuring robust protection of information assets, compliance with security policies, and the effective mitigation of security risks. Through close collaboration with IT, legal, compliance, and security teams, the BISO contributes to the overall security strategy and resilience of the organization.

Essential Functions

• Prioritize, oversee, and manage security and compliance related projects and business-as-usual activities in the brand, ensuring successful execution and reporting. These projects and activities span across Identity and Access Management, Governance Risk and Compliance, Security Architecture, Maritime Safety, Infrastructure Application and Data Security, and Threat Management. 1. Resource Allocation: Proposing and allocating funds for security tools, software, and hardware to protect the company's information assets. Risk Management: Budgeting for risk assessments, penetration testing, and other security assessments to identify vulnerabilities and mitigate risks. Compliance: Proposing and allocating funds for compliance efforts to meet legislative and regulatory requirements related to information security. Continuous Improvement: Allocating funds for ongoing security improvements, such as security updates, patches, and upgrades to existing