Manager – Information Security GRC

easypaisa digital bank; Islamabad; Presencial; PKR 2.400.000 - 4.800.000; Jornada completa

Descripción de la vacante

easypaisa is Pakistan’s first digital bank and leads in digital finance. The incumbent will manage the Information Security Governance, Risk & Compliance (GRC) function, ensuring policy implementation, risk management, regulatory compliance, and robust security governance across the organization.

The role supports the Head of GRC/CISO in identifying, assessing, monitoring, and reporting information security risks, maintaining risk registers, coordinating audits, and ensuring SBP and industry

Formación

• Bachelor’s degree; certifications such as CISM/CRISC/CISA preferred.
• Experience with SBP regulations, ISO 27001, NIST CSF and PCI DSS.
• Strong governance, risk and compliance (GRC) capabilities.

Responsabilidades

• Manage Information Security GRC framework and risk assessments.
• Maintain SBP regulatory compliance and information security policies.
• Coordinate internal and external audits and regulatory inspections.
• Develop KRIs, KPIs and MIS for senior management.
• Lead and develop the GRC team and collaborate with stakeholders.

Conocimientos

GRC governance

Risk management

Regulatory compliance

Information security policies

Audit coordination

Third-party risk assessment

SBP regulations

ISO/IEC 27001

NIST CSF

PCI DSS

Vendor due diligence

GRC tooling experience

Educación

Bachelor's degree

Herramientas

GRC tools

Descripción del empleo

easypaisa is Pakistan’s first digital bank and has advanced Pakistan’s digital finance landscape. Backed by our shareholders, Telenor Group-a leading telecom operator in Asia and the Nordics- and Ant Group-the force behind Alipay, the world’s leading open internet platform, easypaisa deliver secure, convenient financial solutions to millions of Pakistanis.

Position Summary:

The incumbent will be responsible for managing and strengthening the Information Security Governance, Risk & Compliance (GRC) function by ensuring effective implementation of information security policies, risk management frameworks, regulatory compliance requirements, and security governance practices across the organization.

The role will support the Head of GRC and Chief Information Security Officer (CISO) in identifying, assessing, monitoring, and reporting information security risks, maintaining the Information Security Risk Register, coordinating internal and external audits, and ensuring compliance with applicable State Bank of Pakistan (SBP) regulations, industry standards, and organizational policies.

Duties and Responsibilities:

• Manage and maintain the Information Security Governance, Risk & Compliance framework, ensuring alignment with organizational objectives, regulatory requirements, and industry-recognized security standards.
• Maintain the Information Security Risk Register and conduct periodic risk assessments, including risk identification, evaluation, treatment, acceptance, monitoring, and reporting across business processes, applications, infrastructure, and emerging technologies.
• Ensure compliance with applicable State Bank of Pakistan (SBP) regulations, circulars, guidelines, and relevant industry frameworks, including ISO/IEC 27001, NIST CSF, and PCI DSS.
• Develop, review, and maintain information security policies, standards, procedures, and guidelines, ensuring alignment with regulatory requirements and organizational security objectives.
• Coordinate internal and external information security audits, regulatory inspections, and compliance assessments, including evidence management, gap analysis, corrective action plans, and timely closure of audit observations.
• Conduct third-party information security risk assessments, including vendor due diligence, onboarding reviews, periodic security assessments, and evaluation of contractual security requirements.
• Review Business Requirement Documents (BRD), Product Requirement Documents (PRD), technology change requests, and third-party integrations to identify information security risks and ensure appropriate security controls are incorporated.
• Monitor risk treatment plans, security control deficiencies, policy exceptions, and risk acceptance requests, ensuring appropriate approvals, remediation tracking, and escalation of overdue or high-risk matters.
• Develop and maintain information security Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), compliance dashboards, and Management Information System (MIS) reports for senior management and relevant governance committees.
• Collaborate with Information Security Operations, Application Security, IT, Enterprise Risk Management, Compliance, Legal, and business stakeholders to ensure effective security governance, regulatory compliance, and risk mitigation.
• Support the implementation and continuous improvement of GRC tools, security awareness initiatives, control assessments, and governance processes to strengthen organizational cybersecurity maturity.
• Manage assigned team members, oversee timely completion of GRC activities, and undertake any additional responsibilities assigned by the Head of GRC, Head of Information Security, or Chief Information Security Officer (CISO).

Education:

Bachelors (relevant certifications are preferred i.e. CEH, CHFI, CISM, CRISC, CISA, CISSP, ISO/IEC 27001 Lead Implementer/Auditor

Experience:

2 -5 Years in relevant domains & at similar capacity

• Governance, Risk and Compliance Activities
• Compliance Reviews
• SBP Regulations, ISO/IEC 27001, NIST CSF, COBIT, PCI DSS