Information Technology Governance Manager

About the role

ASA Microfinance Bank (Pakistan) Limited is looking for an experienced and results-driven Information Technology Governance Manager to join its team at Head Office. The role covers IT governance, risk and compliance, audit support and reporting.

Key responsibilities

• Support the development and maintenance of IT governance frameworks, policies and procedures.
• Ensure compliance with regulatory requirements and internal IT policies.
• Coordinate internal, external and regulatory IT audits, track observations, risks, issues and corrective actions.
• Conduct IT risk assessments and monitor compliance activities.
• Monitor IT projects and ensure compliance with governance processes.
• Prepare governance dashboards, risk reports and management updates.
• Coordinate with IT, Information Security, Risk, Compliance and Audit teams.
• Support business continuity planning and disaster recovery exercises.
• Identify governance gaps and recommend process improvements.

Required profile

• Bachelor's degree in information technology, computer science, business administration or a related field; a Master's degree is an advantage.
• 5 years of relevant experience in IT governance, risk and compliance, IT audit, project governance or related functions.
• Banking or financial services experience is preferred.
• Strong communication, analytical and problem-solving skills, good documentation and reporting, strong stakeholder management, and ability to manage multiple tasks and meet deadlines.

Required skills

• IT governance frameworks, regulatory requirements and banking compliance standards.
• IT risk assessments, RCSA and information security controls.
• Internal, external and regulatory IT audits, including evidence management and remediation.
• Familiarity with ISO 27001, ETGRM and NESA.
• Knowledge of IT policies, procedures, SOPs, SLAs and OLAs.
• IT governance reporting, dashboards, risk monitoring and compliance tracking.
• Business continuity planning, disaster recovery and business impact analysis.
• Vulnerability assessment and penetration testing (VAPT).