GRC Manager – Information Security Governance

About the role

The GRC Manager will lead the Information Security Governance, Risk & Compliance function, ensuring that Mobilink Bank’s security, privacy, technology risk and AI governance align with regulatory requirements, international standards and the bank’s risk appetite. The role supports the Head of GRC in overseeing risk assessments, regulatory compliance, audit activities and third‑party security oversight.

Key responsibilities

• Develop, maintain and continuously improve the GRC framework, policies, standards and control libraries.
• Coordinate security risk assessments, maintain the risk register and monitor treatment, acceptance and remediation actions.
• Manage compliance with SBP, Group/VEON, ISO 27001, PCI DSS and other regulatory mandates.
• Lead ISO 27001 ISMS activities, audits, certification and continual improvement initiatives.
• Monitor critical security controls such as IAM, PAM, vulnerability management, SIEM/SOC, endpoint security, DLP and security monitoring.
• Oversee third‑party, cloud and emerging‑technology risk assessments and track remediation of identified gaps.
• Facilitate internal and external audit processes, collect evidence and ensure timely closure of findings.
• Prepare dashboards and reports on security risks, compliance status, KPI/KRI performance and remediation progress.

Required profile

• Bachelor’s or Master’s degree in Information Security, Cybersecurity, Computer Science or related field.
• Professional certifications such as CISM, CISA or ISO/IEC 27001 Lead Auditor/Implementer are desirable.
• Proven experience in information security governance, risk management, compliance or audit within a regulated environment.
• Strong knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, PCI DSS and data‑privacy regulations.
• Excellent analytical, documentation and stakeholder‑management skills.

Required skills

• ISO/IEC 27001 implementation and audit
• NIST Cybersecurity Framework
• PCI DSS compliance
• Identity and Access Management (IAM) and Privileged Access Management (PAM)
• Vulnerability Management and Patch Management
• SIEM/SOC operations
• Endpoint Security solutions
• Data Loss Prevention (DLP) and security monitoring tools