Security and Operational Risk Consultancy (Islamabad)

About the role

The Legal Aid Society (LAS), a Karachi-based non-profit providing free legal aid and advocating for access to justice, is running a multi-year access-to-justice programme across Punjab, Sindh and Islamabad Capital Territory. It needs an experienced Islamabad-based firm or consultant to provide security risk management and operational readiness support during the first year of the programme and to assess LAS's security practices. The consultancy lasts 8-12 months and reports to the Program Manager.

Key responsibilities

• Finalise a Programme Security Plan covering in-person event safety, safe movement and field travel, online programme security, staff emergency procedures and contingency arrangements.
• Finalise an Incident Reporting Protocol with incident categories, escalation thresholds, reporting templates, documentation standards and response timelines.
• Deliver a one-time security induction to programme staff and run a mid-term review of the Security Plan around month 6.
• Provide monthly security situation updates to the Program Manager.
• Assess the three information platforms used in programme delivery (case management system, ERP software and digital helpline) for access controls, data storage and transmission security, user authentication and configuration vulnerabilities.
• Produce an IT Vulnerability Assessment Report with findings by severity (Critical, High, Medium, Low) and a prioritised remediation plan, then verify that all Critical and High findings are resolved.

Required profile

• A registered firm or experienced individual consultant with at least 5 years in Pakistan in security risk management or related consultancy.
• Team lead with at least 10 years of experience in security risk management, including advising non-profit, development or human rights organisations in high-risk environments.
• Professional networks with public institutions in Islamabad and the provinces, and experience supporting organisations with operational and administrative requirements.
• Familiarity with international donor standards on duty of care, security and data protection, and strict confidentiality and a do-no-harm approach.
• An office or established presence in Islamabad.

Required skills

• Digital security reviews, including access control standards, data protection requirements and vulnerability assessment methodologies.
• Basic knowledge of web-based or cloud-hosted platform security.
• Relevant certification such as CPP, CEH, CompTIA Security+ or equivalent is an added advantage.

Applicants must submit a firm/consultant profile, CVs of the team lead and proposed team members, evidence of similar assignments with two references, a technical proposal and a financial proposal. Payment is made in installments against the deliverables listed in the schedule.