Chief Manager / Engineer – IT and Operational Risk

Sui Southern Gas Company Limited; Karachi Division; On-site; PKR 1,800,000 - 3,000,000; Full time

Job summary

Sui Southern Gas Company Limited seeks a Chief Manager / Engineer – IT and Operational Risk to lead enterprise risk management and information security initiatives. The role requires engineering or computing credentials with extensive experience in risk governance, compliance, and ISO standards.

The successful candidate will drive ERM maturity, assess security controls, and oversee IT/OT risk programs. As a senior professional, you will mentor teams, coordinate cross-functional risk efforts and

Qualifications

• Engineering degree in Mechanical or Electrical with 9+ years of relevant experience or BCS/equivalent with 10+ years of experience.
• Registration with PEC mandatory for engineers. Certifications such as CISA/CRISC/CISSP preferred. ISO 31000 training would be a plus.

Responsibilities

• Establishes and communicates the Enterprise Risk Management Framework and guides ERM maturity.
• Implements ERM framework, risk culture, risk policies and risk appetite with senior management.
• Designs ERM methodologies, tools and techniques across the organization.
• Manages enterprise-wide risk assessments and monitors priority risks.
• Leads risk management for information security programs and ISO 2700X implementation.
• Develops IT risk metrics, reports, and configuration/standards management.
• Assesses security controls and risks for information and technology systems.
• Leads information security compliance program and regulatory alignment.
• Coordinates IT/OT risk assessments, timelines, and outcomes.
• Provides guidance to IT processes and projects on security best practices.

Skills

ERM

Information security

Risk management

PEC registration

Education

Engineering degree (Mechanical/Electrical)

BCS or equivalent

Job description

Chief Manager / Engineer – IT and Operational Risk

November 02, 2026

JOB DETAILS:

Qualification & Experience:

Engineering Graduate (Mechanical / Electrical) with at least 9 years of relevant experience. Or BCS or equivalent with at least 10 years of relevant experience.

Candidate must have at least 04 years of relevant experience as a Functional / Team Lead. Registration with PEC is mandatory for Engineers. Preferred Certifications in CISA, CRISC, CISSP, etc. Training in ISO 31000 on risk management will be a plus.

Responsibilities:

• Establishes and communicates the organization’s Enterprise Risk Management Framework, objectives and direction and provide guidance to achieve the ERM maturity model developed by the company
• Implements ERM Framework, Risk Culture and Recommends risk management policies, risk appetite and risk limits to Executive Management.
• Designs, communicates and facilitates the use of appropriate Enterprise Risk Management methodologies, tools and techniques across the organization.
• Controls enterprise-wide risk assessments and monitors priority risks across the organization.
• Lead the development / implementation of system-wide risk management function of the information security program to ensure information security risks are identified & monitored
• Must have knowledge and experience of implementation of Information Security Management Systems based on ISO 2700X
• Advance the design, delivery, and performance of lT risk metrics and reports including the Business Impact Assessment, lT Risk Management Framework, and the management of configurations and standards
• Assess, evaluate and make recommendations to management regarding the adequacy of the security controls, risks involved for the organization’s information and technology systems
• Lead the system-wide information security compliance program, ensuring lT activities, processes, and procedures to meet defined requirements, policies and regulations
• Lead enterprise, network, application, and cloud infrastructure risk assessments while maintaining process and procedural documentation
• Coordinate and track all Operational, lT Risks, information technology and security related assessments including scope of assessment, parties involved, timelines, and outcomes
• Provides insight and guidance to IT processes and projects to ensure best practices and security standards are maintained
• Operate with a high degree of independence with regard to project management activities, including development of project plans and budget/resource estimates
• Excellent knowledge and experience of information security, audit, risk management, compliance or risk consulting experience
• Arranges and conducts Risk Workshops for confirmation of the Risk Registers and for identifying risks and mitigation controls of Risks
• Provides guidance, coordination and subject matter expertise to business functions to ensure the implementation of the agreed risk management strategy.
• Works with all functional groups to establish, maintains and continuously improve risk management capabilities.
• Manage relationships with external consultants and supervise work programs.
• Plan the risk management related awareness amongst SSGC IT and Operation / Technical departments regarding the need and importance of this exercise as well as correct implementation of the program through guided training sessions and/or e-learning modules.
• Guide the IT function to undertake a thorough information systems risk assessment in order to obtain an understanding of the risks to the availability, integrity and confidentiality of data and systems.
• Ensure that such risk assessment encompasses all systems, including hardware, software, data, networks and any business processes to identify threats, vulnerabilities, probabilities of occurrence and potential impact.
• Ensure close coordination with individual technical or operational departments in proper articulation of key risks and determination of the severity of impact as well as probability of its occurrence, using a top-down as well as a bottom-up approach.
• Develop a common set of assessment criteria that can be used across operating departments and determine how much risk the organization faces.
• Identify and analyze risks and risk indicators pertaining to loss of critical systems, key suppliers, key employees etc.

• Establishes and communicates the organization’s Enterprise Risk Management Framework, objectives and direction and provide guidance to achieve the ERM maturity model developed by the company
• Implements ERM Framework, Risk Culture and Recommends risk management policies, risk appetite and risk limits to Executive Management.
• Designs, communicates and facilitates the use of appropriate Enterprise Risk Management methodologies, tools and techniques across the organization.
• Controls enterprise-wide risk assessments and monitors priority risks across the organization.
• Lead the development / implementation of system-wide risk management function of the information security program to ensure information security risks are identified & monitored
• Must have knowledge and experience of implementation of Information Security Management Systems based on ISO 2700X
• Advance the design, delivery, and performance of lT risk metrics and reports including the Business Impact Assessment, lT Risk Management Framework, and the management of configurations and standards
• Assess, evaluate and make recommendations to management regarding the adequacy of the security controls, risks involved for the organization’s information and technology systems
• Lead the system-wide information security compliance program, ensuring lT activities, processes, and procedures to meet defined requirements, policies and regulations
• Lead enterprise, network, application, and cloud infrastructure risk assessments while maintaining process and procedural documentation
• Coordinate and track all Operational, lT Risks, information technology and security related assessments including scope of assessment, parties involved, timelines, and outcomes
• Provides insight and guidance to IT processes and projects to ensure best practices and security standards are maintained
• Operate with a high degree of independence with regard to project management activities, including development of project plans and budget/resource estimates
• Excellent knowledge and experience of information security, audit, risk management, compliance or risk consulting experience
• Arranges and conducts Risk Workshops for confirmation of the Risk Registers and for identifying risks and mitigation controls of Risks
• Provides guidance, coordination and subject matter expertise to business functions to ensure the implementation of the agreed risk management strategy.
• Works with all functional groups to establish, maintains and continuously improve risk management capabilities.
• Manage relationships with external consultants and supervise work programs.
• Plan the risk management related awareness amongst SSGC IT and Operation / Technical departments regarding the need and importance of this exercise as well as correct implementation of the program through guided training sessions and/or e-learning modules.
• Guide the IT function to undertake a thorough information systems risk assessment in order to obtain an understanding of the risks to the availability, integrity and confidentiality of data and systems.
• Ensure that such risk assessment encompasses all systems, including hardware, software, data, networks and any business processes to identify threats, vulnerabilities, probabilities of occurrence and potential impact.
• Ensure close coordination with individual technical or operational departments in proper articulation of key risks and determination of the severity of impact as well as probability of its occurrence, using a top-down as well as a bottom-up approach.
• Develop a common set of assessment criteria that can be used across operating departments and determine how much risk the organization faces.
• Identify and analyze risks and risk indicators pertaining to loss of critical systems, key suppliers, key employees etc.
• into the risk management program along with the corresponding business continuity decisions.
• Help the departments in categorization of the risks according to a pre-defined criterion into categories including “critical”, “catastrophic” etc.
• Based on level of severity and likelihood of happening (e. g. almost certain, likely, possible).
• Assess key risk areas including operations risk, compliance risk, legal risk, liquidity risk etc.
• Provide feedback to departmental heads on steps needed to mitigate these risks.

Copyright (c) 2018-2026 Sui Southern Gas Company Limited. All Rights Reserved.