Manager – Information Security GRC

About the role

easypaisa, Pakistan's first digital bank, is looking for a Manager – Information Security GRC to manage and strengthen its Information Security Governance, Risk & Compliance function. The role supports the Head of GRC and the Chief Information Security Officer (CISO) in identifying, assessing, monitoring and reporting information security risks, maintaining the risk register, coordinating audits and ensuring compliance with State Bank of Pakistan regulations and industry standards.

Key responsibilities

• Manage and maintain the Information Security GRC framework aligned with organizational objectives, regulatory requirements and standards such as ISO/IEC 27001, NIST CSF and PCI DSS.
• Maintain the Information Security Risk Register and run periodic risk assessments covering business processes, applications, infrastructure and emerging technologies.
• Ensure compliance with SBP regulations, circulars and guidelines, and develop, review and maintain security policies, standards, procedures and guidelines.
• Coordinate internal and external audits, regulatory inspections and compliance assessments, including evidence management, gap analysis, corrective action plans and closure of audit observations.
• Conduct third-party risk assessments and vendor due diligence, and review BRDs, PRDs, technology change requests and integrations for security risks.
• Monitor risk treatment plans, control deficiencies, policy exceptions and risk acceptance requests, and track remediation and escalations.
• Develop KRIs, KPIs, compliance dashboards and MIS reports for senior management and governance committees.
• Collaborate with Information Security Operations, Application Security, IT, Enterprise Risk Management, Compliance and Legal, and support GRC tools, security awareness and control assessments.
• Manage assigned team members and report to the Head of GRC, Head of Information Security or CISO.

Required profile

• Bachelor's degree; relevant certifications such as CEH, CHFI, CISM, CRISC, CISA or CISSP are preferred.
• 2 to 5 years of experience in relevant domains at a similar capacity.

Required skills

• Governance, risk and compliance activities, risk assessments and compliance reviews.
• Audit engagements and knowledge of SBP regulations, ISO/IEC 27001, NIST CSF, COBIT and PCI DSS.
• Strong Excel and dashboarding skills.