Senior Security Engineer: metrics definition for an IS program