General Manager Cybersecurity & Technology Risk (CISO)

About the role

PIA is hiring a General Manager Cybersecurity & Technology Risk (CISO) in Islamabad, reporting to the Chief Information Officer. The role protects the airline's systems, data and operations and owns technology governance, risk and compliance, giving the CEO and the Board an independent view of technology risk. It also covers the controls behind airworthiness and crew regulatory records, carrying safety weight as well as security weight.

Key responsibilities

• Define and maintain the enterprise security strategy and architecture across all systems, networks and sites.
• Run the managed security service: continuous monitoring, incident detection and response, threat intelligence and vulnerability management.
• Own the cybersecurity roadmap and its delivery through managed security service partners, based on an assessment of the airline's security posture.
• Maintain an airline-wide technology risk register, recommend but not grant risk acceptance, and report the risk position through IT governance.
• Set the technology policy framework, track compliance and liaise with internal audit and the regulator.
• Own the technology controls protecting airworthiness and crew regulatory records, working with Flight Safety and Engineering.
• Own identity and access management, including privileged access and joiner, mover and leaver controls with HR.
• Own technology disaster recovery, maintaining recovery plans and proving them through resilience exercises.
• Assure vendor and delivery partner security, and lead the path to security certification.
• Run a regular security and risk review cadence and report to the CIO and senior management.
• In the first six months: deliver priority actions of the cybersecurity roadmap and establish the technology risk register.

Required profile

• 15+ years in cybersecurity and technology risk, with senior leadership of a security function in a large enterprise.
• A recognised security leadership certification such as CISSP or CISM, or equivalent standing.
• Experience in regulated or safety-critical environments; aviation or critical infrastructure strongly preferred.
• Track record directing managed security services and leading incident response at scale.
• Degree in a relevant field; a risk or governance qualification is preferred.

What we offer

• Senior leadership of a core function at a national flag carrier.
• Market-competitive remuneration.
• Company car, car maintenance and fuel.
• Air tickets in line with company policy.