Manager GRC

Mobilink Microfinance Bank Limited; Islamabad; On-site; PKR 3,500,000 - 5,200,000; Full time

Job summary

Mobilink Bank is seeking an AVP to lead Information Security Governance, Risk & Compliance (GRC) at head office in Islamabad. You will coordinate risk assessments, regulatory compliance, audits and security controls across IAM, SIEM, DLP and more.

Ideal candidate holds a related degree with certifications like CISM/CISA and ISO 27001 Lead Auditor/Implementer, and has extensive governance and stakeholder management experience in a banking environment.

Qualifications

• Bachelor's or Master's degree in Information Security, Cybersecurity, Computer Science, Information Technology or related discipline.
• CISM, CISA, ISO/IEC 27001 Lead Auditor/Implementer or equivalent desirable.
• Experience in information security governance, cybersecurity risk, compliance, audit, regulatory compliance or technology risk management.
• Knowledge of ISO/IEC 27001, NIST CSF, PCI DSS, information security risk management and cybersecurity governance.

Responsibilities

• Manage and continuously improve the Information Security Governance, Risk & Compliance (GRC) framework.
• Develop, review and maintain information security policies, standards, procedures and control frameworks.
• Coordinate information security and cybersecurity risk assessments, maintain the risk register, and monitor risk treatment, acceptance and remediation.
• Manage regulatory and security compliance activities, including SBP, Group/VEON, ISO 27001 and PCI DSS requirements.
• Coordinate ISO 27001 ISMS activities, audits, certification/surveillance requirements and continual improvement initiatives.
• Monitor key security controls across IAM, PAM, Vulnerability Management, SIEM/SOC, Endpoint Security, DLP and Security Monitoring.
• Coordinate third-party, cloud and technology security risk assessments and track remediation of identified risks and exceptions.
• Coordinate internal and external security audits, evidence collection, management responses and closure of audit findings.
• Maintain governance trackers for risks, compliance gaps, audit findings, exceptions, initiatives and remediation actions.
• Prepare management dashboards and reports covering security risks, compliance, control effectiveness, KPIs/KRIs and remediation progress.
• Support security governance forums and ensure timely escalation of significant risks, compliance issues and overdue actions.

Skills

GRC management

Regulatory compliance

Stakeholder management

Audit coordination

Risk assessment

Education

Bachelor's or Master's in Information Security or related

Tools

CISM

CISA

ISO/IEC 27001 Lead Auditor/Implementer

Job description

Job Grade: AVP

Reports to: Head of IS Governance

Location: Head Office, Islamabad

Job Purpose

Manage and execute Information Security Governance, Risk & Compliance (GRC) activities to ensure that the organization’s information security, cybersecurity, privacy, technology risk and AI governance practices remain aligned with applicable regulatory requirements, international standards, organizational policies and enterprise risk appetite.

The role will support the Head of GRC in managing information security governance, risk assessments, regulatory compliance, audit and assurance, security control monitoring, third-party risk, privacy and emerging technology governance. The position will coordinate with business, technology and control functions to identify, assess, track and remediate information security risks and compliance gaps.

Key Responsibilites

• Manage and continuously improve the Information Security Governance, Risk & Compliance (GRC) framework.
• Develop, review and maintain information security policies, standards, procedures and control frameworks.
• Coordinate information security and cybersecurity risk assessments, maintain the risk register, and monitor risk treatment, acceptance and remediation.
• Manage regulatory and security compliance activities, including SBP, Group/VEON, ISO 27001 and PCI DSS requirements.
• Coordinate ISO 27001 ISMS activities, audits, certification/surveillance requirements and continual improvement initiatives.
• Monitor key security controls across areas including IAM, PAM, Vulnerability Management, SIEM/SOC, Endpoint Security, DLP and Security Monitoring.
• Coordinate third-party, cloud and technology security risk assessments and track remediation of identified risks and exceptions.
• Coordinate internal and external security audits, evidence collection, management responses and closure of audit findings.
• Maintain governance trackers for risks, compliance gaps, audit findings, exceptions, initiatives and remediation actions.
• Prepare management dashboards and reports covering security risks, compliance, control effectiveness, KPIs/KRIs and remediation progress.
• Support security governance forums and ensure timely escalation of significant risks, compliance issues and overdue actions.

Job Requirements

• Bachelor's or Master's degree in Information Security, Cybersecurity, Computer Science, Information Technology or a related discipline.
• Relevant professional certifications such as CISM, CISA, ISO/IEC 27001 Lead Auditor/Implementer or equivalent are desirable.
• Relevant experience in information security governance, cybersecurity risk, compliance, audit, regulatory compliance or technology risk management.
• Working knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, PCI DSS, information security risk management and cybersecurity governance.
• Understanding of information privacy, data protection and emerging AI governance requirements.
• Experience in coordinating with business, technology, risk, audit and compliance stakeholders.
• Experience in preparing management reports, risk dashboards, compliance assessments and audit responses.
• Strong analytical, documentation, communication and stakeholder management skills.
• Ability to manage multiple GRC activities, prioritize deliverables and track remediation within defined timelines.

About Mobilink Bank

Mobilink Bank is providing banking services to over 64.22 million registered users including 21 million monthly active customers across Pakistan. With a hybrid model that combines traditional microfinance with mobile/digital banking technologies, the bank now operates with over 132 branches and 324,000 branchless banking agents and provides a USSD (GSM) based digital channel offering savings, micro enterprise (MSME) loans, small housing loans, remittances, collection (utility bills and loan instalments), mobile wallets, insurance, G2P, B2B & B2P payments; thus, playing a leading role in the promotion of financial inclusion. Mobilink Bank is committed to fostering a positive and productive workplace, and our core values reflect this focus. These values include promoting innovation and entrepreneurship, encouraging teamwork and collaboration, and prioritizing a customer-centric approach in all aspects of our business.

Why Join Mobilink Bank?

This is an opportunity for someone who is passionate about making a difference and playing a key role in driving transformative change. Our team is committed to empowering millions with the tools necessary to succeed in the digital age, and we're looking for a talented individual to join us in this endeavour.