Manager – Cyber & InfoSec Operations

Oman Housing Bank | بنك الإسكان العُماني; Muscat; On-site; OMR 25,000 - 38,000; Full time

Job summary

Oman Housing Bank is seeking an experienced Manager – Cyber & Information Security (InfoSec) Operations to lead the bank's cyber defense, incident response, and regulatory compliance efforts. The role includes managing incident handling, forensics, and third-party coordination across platforms and vendors.

Responsibilities include refining incident response plans, conducting RCA, and driving improvements in threat detection and response capabilities in a regulated banking environment.

Qualifications

• Bachelor degree in information security, cybersecurity, or a related field.
• Professional certifications (e.g., CISSP, GCIH, GCFA) are preferred.
• Minimum 4 years of cybersecurity experience, with at least 2 years in banking or a regulated environment.
• Experience with SIEM, EDR and digital forensics tools.

Responsibilities

• Oversee end-to-end cybersecurity incident response lifecycle.
• Lead root cause analysis and preserve digital evidence for compliance.
• Maintain and test incident response plans and playbooks.
• Coordinate with MSSPs and third-party vendors for monitoring and escalation.
• Develop IS security policies, controls, and RBAC/PAM procedures.
• Manage ISO 27001 program, ISMS documentation, and audits.

Skills

Incident response

ISMS

Security governance

Stakeholder communication

Education

Bachelor Degree in Information Security

CISSP

Tools

SIEM

EDR

Forensics platforms

Job description

Job Purpose:

The Manager – Cyber & Information Security (InfoSec) Operations supervises the bank’s cyber defense operations, ensuring timely detection, response, and resolution of security incidents. He/ She operates incident handling, digital forensics, and third-party cybersecurity coordination while maintaining compliance with regulatory and internal security frameworks. The role supports key operational security controls, drives continuous improvements in threat response, and collaborates with stakeholders to safeguard the bank’s information assets across platforms and vendors.

Key Accountabilities:

• Manages the full lifecycle of cybersecurity incident response including detection, triage, containment, eradication, recovery, and post-incident review.
• Conducts Root Case Analysis (RCA) [HH1] of compromised systems and preserves digital evidence for compliance and legal use.
• Updates and tests the incident response plan and playbooks to ensure readiness.
• Investigate security incidents such as unauthorized access, insider threats, and external attacks.
• Interfaces with MSSPs and third-party vendors for alert triage, escalation, and monitoring performance.
• Optimizes SIEM rules, detection logic, and response workflows with vendors and internal teams.
• Conducts regular meetings with vendors to review SLAs, resolve issues, and improve service levels.
• Evaluates emerging cybersecurity technologies and engages with vendors to enhance capabilities.
• Conducts risk assessments, vulnerability scans, and penetration testing to identify and mitigate threats.
• Implements and maintains the Bank’s information security program in compliance with regulatory and business standards.
• Develops and enforces cybersecurity policies, standards, and procedures in alignment with frameworks (ISO 27001, CBO, MTCIT).
• Manages ISO 27001 certification efforts and maintains ISMS documentation and audit readiness.
• Maintains the cybersecurity risk register, audit findings, and remediation tracking.
• Performs user access reviews and privileged access reviews for critical systems in compliance with RBAC and regulatory requirements.
• Manages enforcement of PAM controls and maintains evidence of periodic access reviews.
• Approves firewall, system, and administrative access changes as the designated ISO authority.
• Coordinates with HR to manage onboarding and offboarding access controls for staff, vendors, and contractors.
• Provides security input for new IT and business projects, ensuring risk mitigation is embedded in solution design.
• Conduct security assessments, architectural reviews, and integration support for new systems.
• Communicates incident updates, risks, and resolutions to stakeholders across IT, Legal, Compliance, and Business Units.
• Develops and delivers cybersecurity awareness and training programs to staff.
• Fosters a culture of accountability, proactive defense, and information security ownership.
• Leads cyber drill simulations and incident response exercises to improve response capabilities.
• Ensures compliance with data protection regulations and internal privacy policies.
• Develops and maintains privacy notices, consent forms, and data handling procedures.
• Manages data subject access requests and leads investigations into privacy-related incidents.
• Acts as the main liaison with Data Protection Authorities during audits or investigations.
• Executes the information security roadmap aligned with enterprise risk strategy.
• Ensures ongoing adherence to cybersecurity best practices, regulatory mandates, and corporate security policies.
• Maintains high standards of professionalism, accuracy, and integrity in all operational duties.
• Collaborates with internal functions to sustain an enterprise-wide security and privacy posture.
• Ensures incident reports, root cause analysis documentation, and regulatory compliance submissions are completed following cybersecurity and data privacy incidents.
• Develops dashboards and executive summaries for senior management highlighting the requirement.
• Maintains and regularly updates a comprehensive risk register for third-party security and privacy vendors.
• Ensures compliance with data protection regulations and international best practices, including GDPR, CCPA, CDC, MTCIT, CBO, and PDPL.
• Administers privacy impact assessments (PIAs) and data protection impact assessments (DPIAs), ensuring they are conducted thoroughly and in a timely manner.
• Serves as the primary point of contact for data subjects and regulatory authorities on data privacy inquiries and breach communications, acting in the capacity of the Data Privacy Officer (DPO).
• Implements and monitors data governance policies that ensure secure, lawful, and transparent data processing across all departments.
• Maintains up-to-date records of processing activities (ROPA) and ensures data retention, deletion, and anonymization policies align with applicable legal and regulatory requirements.

Qualifications and Experience:

• Bachelor Degree in Information Security, Cybersecurity, Information Systems or a related field.
• Professional certification in Information Security such as: GCIH, GCFA, GCFE, CISSP, CEH, CISM, ISO 27001) is preferred.
• Minimum of 4 years of experience with at least 2 years in a banking or a regulated environment.
• Familiarity with using cybersecurity tools such as SIEM, EDR and forensic platforms.
• Demonstrates familiarity with country-specific information security regulations and expertise.
• Strong knowledge of related ISO such as ISO 27001 and related global standards.
• Ability to conduct risk assessments, vulnerability assessments and penetration testing.
• Ability to develop IS standards, procedures and controls.

Applicants who are meeting the job requirements will be contacted.

** Applications will be accepted until 15-Nov-2026 at 2:00 P.M

Submissions received after this date and time will not be considered **