InfoSystem LLC, a US-based company, is establishing an in-house SOC. John has been given the responsibility to finalize strategy, policies, and procedures for the SOC. Identify the job role of John.

The role described, which involves defining high-level strategy, policies, and procedures for an organization's security posture, is characteristic of a Chief Information Security Officer (CISO). The CISO is a senior-level executive responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets are adequately protected. This includes overseeing the development of security policies and procedures that govern the Security Operations Center (SOC) and the entire organization. John's responsibilities align directly with the strategic and governance functions of a CISO, not the operational duties of analysts or engineers.

A. Security Analyst – L1: This is a junior, operational role focused on monitoring alerts and performing initial triage, not setting strategy or policies.
C. Security Engineer: This role is responsible for designing, implementing, and maintaining security infrastructure, not defining overarching organizational security strategy and policies.
D. Security Analyst – L2: This is a mid-level role focused on in-depth incident investigation and response, not the creation of high-level governance documents.

1. National Initiative for Cybersecurity Careers and Studies (NICCS), Cybersecurity & Infrastructure Security Agency (CISA). (2020). NICE Cybersecurity Workforce Framework, NIST Special Publication 800-181 rev 1. "Oversee and Govern" category, role SP-RSK-002 (Cybersecurity Manager) and OV-MGT-001 (Executive Cyber Leadership) describe functions aligned with a CISO's strategic responsibilities. (p. 58, 69).

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004. The paper discusses the evolution of roles, positioning the CISO as the key strategic leader for cybersecurity governance.