Head of Information Security

About the role

Lead the information security, risk and compliance programme for a large financial data bureau, acting as a business enabler while protecting the data of millions of borrowers and member institutions.

Key responsibilities

• Set vision and strategy for security, risk and compliance aligned to ISO 27001, NIST and CIS standards.
• Own the relationship with the State Bank of Pakistan, leading security audits, inspections and regulatory compliance.
• Design and maintain security policies, frameworks, standards and controls, and drive certifications such as ISO 27001.
• Plan and manage cyber‑threat, incident response, monitoring (SIEM/SOAR), breach investigation and reporting.
• Oversee business continuity, disaster recovery and security tooling strategy (firewalls, encryption, DLP, etc.).
• Run VAPT for infrastructure and mobile app, manage third‑party security risk, and build an enterprise‑wide security awareness culture.

Required profile

• 15+ years of experience in information security, risk and compliance, preferably in regulated financial services.
• Proven track record managing regulator audits, ideally with State Bank of Pakistan experience.
• Pragmatic, business‑focused security leader who can enable innovation while managing risk.
• Strong command of security frameworks (ISO 27001, NIST, CIS) and incident response.
• Relevant certifications such as CISSP, CISM, CRISC or ISO 27001 Lead Auditor/Implementer.

Required skills

• ISO 27001, NIST, CIS frameworks
• SIEM, SOAR platforms
• Firewalls, encryption, DLP solutions
• Vulnerability assessment and penetration testing (VAPT)
• Risk register management and key risk indicators (KRIs)