Assistant Manager Information Security - Risk Management & Compliance

Zong 5G; Islamabad; On-site; PKR 1,800,000 - 3,000,000; Full time

Job summary

Zong 5G in Islamabad seeks an Assistant Manager Information Security - Risk Management & Compliance to lead the Security GRC program, aligning policies and controls with ISO, CIS and NIST standards, and to plan security enhancements.

You will manage vulnerability assessments, audits, risk assessments and audits, and remediation with cross-functional teams, reporting to the Sr. Manager Information Security - Governance & Architecture, and supporting regulators and internal auditors.

Qualifications

• Bachelor's degree in Computer Science or Engineering.
• 7 years overall technology experience.

Responsibilities

• Analyze and recommend security controls for systems, apps, and networks to meet risk/compliance objectives.
• Coordinate vulnerability audits, penetration tests, and forensic IT investigations and feed findings into projects.
• Advise on best security solutions to improve network security architecture.
• Collaborate across functions to meet governance goals and information lifecycle standards.
• Support internal and external security auditors and regulators.
• Assist internal teams to align programs with the security control framework.
• Plan business risk assessments and annual security assessment plans; identify weaknesses and remediate.

Skills

Penetration Testing

OWASP Top 10

Android/iOS Testing

API Testing

Red Teaming

Adversary Simulation

Source Code Review

SAST Review

Education

Bachelor's degree in Computer Science or Engineering

Tools

Burp Suite

Nessus/Tenable

Nmap

Metasploit

Qualys

Wireshark

Kali Linux

OWASP ZAP

SQLMap

Job description

Department & Function: Information Security

Position: Assistant Manager Information Security - Risk Management & Compliance

Location: Islamabad

Reporting to: Sr. Manager Information Security - Governance & Architecture

Job Type: Permanent

Job Purpose:

Responsible for our growing Security GRC program that has the ability to quickly ramp up on Security requirements needed in order to achieve implement Policies & Security controls in line with Global Standards. i.e. ISO, CIS & NIST etc. Plans security enhancements, Vulnerability Assessments, Penetration Testing, Risk Assessments and solutions for preventive and reactive measures.

Job Responsibilities:

• Analyze & recommend security controls for systems, web applications, Mobile Applications etc Designing security strategy phases needed to achieve information Risk compliance objectives against a deadline.
• Oversight, planning and execution of any required vulnerability audits, penetration tests or forensic IT audits or related investigations need to ensure that any findings are fed into projects improving organizations overall IT Security.
• Advise for best security solution according to different threats to overall improve the security architecture of network.
• Cross-functional collaboration and capability development to ensure governance goals, information management lifecycle standards and best practices, for both physical and electronic information is reached.
• Support business relationship with the internal & external security auditors and regulators.
• Assists internal teams to ensure successful programs that align with security control program.
• Plan Business Risk Assessment / internal external vulnerability assessment /PT of critical existing business applications
• Planning and execution of Annual security assessment plan, identification and resolution of weaknesses.

Eligibility Criteria (Education, Knowledge, Experience and Skills):

• In principle, have a Bachelor's degree, preferably in Computer Science – Engineering.
• Preferably have 7 Years Overall Technology Experience

Skills – Job Specific:

• Network Penetration Testing – OWASP Top 10 – Android/iOS application assessment and API testing API Penetration Testing – Red Teaming & Adversary Simulation – Source Code / SAST Review – i,
• NIST SP 800-115 Penetration Testing Reporting – executive summaries, technical findings,
• CVSS scoring, evidence and remediation recommendations
• Retesting & Remediation Validation Security Tools: Burp Suite, Nmap, Metasploit, Nessus/Tenable, Qualys, Wireshark, Kali Linux, OWASP ZAP, Nikto, SQLMap Scripting.