Information Security Manager - GRC

About the role

The Information Security GRC Manager will lead the Bank’s governance, risk and compliance programme across all subsidiaries, ensuring consistent security policies, risk assessments and regulatory compliance.

Key responsibilities

• Develop, implement and maintain Group Information Security policies, standards and control frameworks.
• Manage the Information Security risk register, conduct risk assessments for projects, systems and third‑party services, and track remediation plans.
• Administer the Bank’s Internal Control System (ICS) for security processes, coordinate periodic reviews and produce management dashboards.
• Coordinate regulatory compliance activities, respond to examinations and maintain registers of regulatory obligations.
• Lead security assurance activities, support internal and external audits, and validate remediation evidence.
• Oversee third‑party security due‑diligence, onboarding reviews and ongoing risk monitoring.
• Drive the security awareness programme, including mandatory training, phishing simulations and communication campaigns.

Required profile

• Bachelor’s degree in Information Security, Computer Science, IT, Risk Management or related field.
• 8‑10 years of experience in information security, cyber risk or GRC, with at least 3‑5 years in a senior GRC leadership role.
• Experience in banking, financial services or other highly regulated industries.
• Relevant certifications such as CISM, CISSP, CRISC, CISA, ISO 27001 Lead Auditor/Implementer, COBIT Foundation, or PCI DSS Professional.