Information Security GRC Analyst

Raqami Islamic Digital Bank; Karachi Division; Presencial; PKR 1.200.000 - 1.800.000; Jornada completa

Descripción de la vacante

Raqami Islamic Digital Bank seeks an Information Security GRC Analyst to strengthen governance, risk, and compliance through assessing security configurations, validating ISO/IEC 27001:2022, PCI DSS, and SBP requirements, and tracking audit findings.

You will coordinate audits with internal and external teams, maintain risk registers, and prepare periodic reports on remediation progress and significant deficiencies, helping ensure regulatory obligations are met.

Formación

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• Professional certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, or CRISC are preferred.
• 0-3 years of experience in information security compliance, IT audit, technology controls, security hardening, or GRC.

Responsabilidades

• Assess security configurations and baseline hardening across servers, databases, endpoints, and networks.
• Validate ISO/IEC 27001:2022 controls, maintain evidence, and support audits.
• Assess PCI DSS controls, coordinate evidence, and track remediation.
• Map SBP regulatory requirements to internal controls and track observations.
• Perform security control assessments evaluating design, implementation, and effectiveness.
• Maintain a centralized audit findings tracker with owners, deadlines, risk ratings, and closures.
• Coordinate with IT and business teams to remediate gaps and validate closures.
• Monitor vulnerabilities, patching gaps, and risky or unsupported systems.
• Document control exceptions and manage risk treatment plans with stakeholders.
• Coordinate with Internal Audit, external auditors, and PCI assessors to maintain audit evidence.
• Prepare periodic management reports on compliance status, remediation progress, and significant deficiencies.

Conocimientos

ISO 27001 controls

PCI DSS

SBP regulations

Audit evidence

Risk management

Vulnerability management

Documentation

Stakeholder communication

Educación

ISO/IEC 27001 Lead Implementer

ISO/IEC 27001 Lead Auditor

CISA

CRISC

Bachelor's degree in Computer Science / IT / Cybersecurity / Engineering

Herramientas

CIS Benchmarks

Audit management tools

Descripción del empleo

Job Title: Information Security GRC Analyst

Department: Information Security

Job Overview

To strengthen Raqami’s governance, risk, and compliance posture by assessing security configurations and controls, validating compliance with ISO/IEC 27001:2022, PCI DSS, and SBP regulatory requirements, tracking remediation of audit findings and control gaps, and coordinating audits, ensuring information security risks are identified, managed, and reported in line with Raqami’s policies and regulatory obligations.

Key Responsibilities

• Conduct periodic security configuration and baseline hardening assessments of servers, databases, endpoints, network devices, and applications against approved security standards and CIS Benchmarks.
• Validate applicable ISO/IEC 27001:2022 controls, maintain compliance evidence, and support internal audits, external audits, and certification surveillance activities.
• Assess applicable PCI DSS controls, validate security requirements, coordinate evidence collection, and track remediation of identified compliance gaps.
• Map applicable SBP regulatory requirements to internal controls, validate implementation, maintain compliance records, and track regulatory observations.
• Perform periodic security control assessments to evaluate control design, implementation, and operating effectiveness, documenting gaps and recommending corrective actions.
• Maintain a centralized tracker for audit findings, regulatory observations, control deficiencies, action owners, target dates, risk ratings, and closure status.
• Coordinate with relevant IT and business teams to remediate identified gaps, validate closure evidence, and elevate overdue or high-risk findings.
• Monitor security vulnerabilities, patching gaps, configuration deviations, and unsupported systems, ensuring remediation is tracked according to approved risk priorities.
• Document control exceptions, assess associated risks, maintain risk registers, and track approved risk treatment plans in coordination with relevant stakeholders.
• Coordinate with Internal Audit, external auditors, certification bodies, and PCI DSS assessors to facilitate assessments and maintain accurate, traceable audit evidence.
• Prepare periodic management reports highlighting compliance status, hardening coverage, open and overdue findings, remediation progress, and significant control deficiencies.

Experience & Qualification Required

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• Professional certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, or CRISC are preferred. Relevant training or certifications in CIS Benchmarks, security configuration management, and system hardening methodologies will be considered an added advantage
• 0-3 years of experience in information security compliance, IT audit, technology controls, security hardening, or GRC, preferably within the banking or financial services sector.

Skills & Competencies

• Knowledge of ISO/IEC 27001:2022 controls, PCI DSS requirements, and SBP regulatory requirements.
• Understanding of CIS Benchmarks, security configuration, and baseline hardening across servers, databases, endpoints, network devices, and applications.
• Ability to perform security control assessments covering control design, implementation, and operating effectiveness.
• Familiarity with audit evidence management, findings tracking, risk registers, control exceptions, and risk treatment plans.
• Awareness of vulnerability management, patching, and unsupported system risks.
• Strong analytical thinking, attention to detail, communication, stakeholder coordination, documentation, report writing, and presentation skills.

Raqami Bank is an equal opportunity employer. We welcome applications from all qualified individuals, including Persons with Disabilities (PWDs), and are committed to fostering an inclusive workplace where everyone has the opportunity to succeed.

Last date to apply: November 16, 2026.