Engineer / Deputy Manager – IT Risk Management

Sui Southern Gas Company Limited; Karachi Division; On-site; PKR 1,800,000 - 3,200,000; Full time

Job summary

Sui Southern Gas Company Limited is seeking an Engineer / Deputy Manager – IT Risk Management to coordinate with the IT department on risk registers and reporting. The role focuses on identifying controls, supporting control design and monitoring control effectiveness across IT processes.

The incumbent will prepare monthly risk reports for management and contribute to enterprise risk management initiatives in alignment with relevant standards and regulators.

Qualifications

• In-depth knowledge of IT risk management, cyber security and related standards/regulations (NIST 800-53, ISO-2700X, COBIT, ITIL).
• Preferred certifications: CISA, CRISC, CISSP.
• PEC registration mandatory for engineers.

Responsibilities

• Coordinate with IT to prepare and update departmental risk registers.
• Prepare periodic progress reports from risk registers for management.
• Identify controls based on risks for IT business processes.
• Support design, implementation and amendment of controls.
• Monitor IT control performance across the business for timely execution.
• Report on risks and control effectiveness to Risk Management Committee.

Skills

IT Risk Management

Cyber Security

Security Standards

NIST/ISO standards

Risk Reporting

Education

Bachelors in Computer Science/IT (4+ yrs)

Bachelors in Computer Engineering (2+ yrs)

Job description

Engineer / Deputy Manager – IT Risk Management

January 12, 2026

JOB DETAILS:

Qualification & Experience:

Bachelor’s in Computer Science / Information Technology or related field with at least 4 years of relevant experience.

Or

Bachelor’s in Computer Engineering with at least 2 years of relevant experience.

In-depth knowledge and understanding of IT Risk Management, Cyber Security, Information or related fields, Security Standards and Regulations (e.g., NIST 800-53, ISO-2700X, COB|T, ITIL etc.)

Preferred Certifications in CISA, CRISC, CISSP.

Training in ISO 31000 on risk management will be a plus.

PEC registration is mandatory for engineers only

Responsibilities:

JOB SUMMARY

The purpose of this position is to coordinate with the IT department in preparing and updating the departmental risk registers. The incumbent is also responsible to prepare periodic progress reports derived from the departmental risk registers for submission to the management.

JOB RESPONSIBILITIES

• Identify controls based on risks for compliance areas of IT business processes.
• Provide support in the design, implementation and amendment of controls.
• Enable continuous improvement, maintains Business Systems, Infrastructure, SSGC controls catalogue, by providing general and technical guidance on how to maintain relevant controls
• Monitor control performance of IT controls across the business for timely and effective execution.
• Report on risks and control effectiveness to Risk Management Committee and Risk & Litigation Committee
• Set the standards, operating procedures, templates and tooling.
• Maintains risk register and track risk exposures against risk appetite.
• Escalate any challenges in executing change (e.g. stakeholder commitment, technical complexity or resource limitations) in a timely manner.
• Identify controls based on risks for compliance areas of IT business processes.
• Provide support in the design, implementation and amendment of controls.
• Enable continuous improvement, maintains Business Systems, Infrastructure, SSGC controls catalogue, by providing general and technical guidance on how to maintain relevant controls
• Monitor control performance of IT controls across the business for timely and effective execution.
• Report on risks and control effectiveness to Risk Management Committee and Risk & Litigation Committee
• Set the standards, operating procedures, templates and tooling.
• Maintains risk register and track risk exposures against risk appetite.
• Escalate any challenges in executing change (e.g. stakeholder commitment, technical complexity or resource limitations) in a timely manner.
• Embed ownership and awareness in first line of defense via training and communication to control owners
• Foster an intelligent risk culture across SSGC through communication, training etc.
• Implementation of SSGC-wide Information Security risk management function.
• Participate in establishing and quantifying the IT department’s “risk appetite”
• Provide inputs in the plan to maintain the enterprise risk management system up-to-date.
• Coordinate with the department as per the plan in order to finalize the entries in the risk registers.
• Assist the IT department in carrying out a thorough information systems risk assessment to obtain an understanding of the risks to the availability, integrity and confidentiality of data and systems.
• Include all systems, including hardware, software, data, networks and any business processes to identify threats, vulnerabilities, probabilities of occurrence and potential impact.
• Contact the departments to check the progress of the actions necessary to mitigate the risks, as specified against each risk within the respective risk register.
• Assist in conducting training and awareness sessions relating to risk management for the employees of the user departments with a view to create a culture where risks are timely identified and removed with appropriate actions.
• Prepares monthly reporting for the management on the status of the identified risks and corresponding mitigation actions.
• Highlight risks which needs to be accepted and for which there may not be any appropriate action.
• Assist the IT department in applying the relevant approach in taking steps to reduce IT risks for some systems, accept IT risks where the department has no viable option but to live with the risks, transfer risks where all or most of the systems/assets are insured and avoid risks where the department decides not to engage in a risky activity.
• Contribute in articles to create risk awareness for publication in the company’s magazines.
• The individual shall ensure compliance to the Enterprise Risk Management Framework enforced in the Company while performing job responsibilities in accordance with his assigned role.
• The individual shall ensure compliance to the Business Principles and Ethics Policy / Code of Conduct.
• Perform any other task assigned by superiors.

Copyright (c) 2018-2026 Sui Southern Gas Company Limited. All Rights Reserved.