Security and Operational Risk Consultancy

Legal Aid Society (LAS); Islamabad; On-site; PKR 1,800,000 - 2,900,000; Part time

Job summary

Legal Aid Society (LAS) in Islamabad invites an experienced security risk management consultancy to support its 12-month programme across Punjab, Sindh and Islamabad. The engagement focuses on security planning, incident reporting, IT vulnerability assessment, and coordination with LAS teams to safeguard staff and information systems.

The consultant will deliver a Programme Security Plan, Incident Reporting Protocol, monthly updates, and a remediation verification process, reporting to the

Qualifications

• 5+ years of standing in Pakistan in security risk management or related consultancy.
• Team lead with at least 10 years in security risk management.
• Established networks with public institutions in Islamabad and provinces.
• Familiarity with international donor standards on duty of care, security and data protection.
• Capacity to maintain strict confidentiality and do-no-harm approach to sensitive information.
• Capacity to conduct basic digital security reviews of web-based or cloud-hosted platforms.

Responsibilities

• Finalise the Programme Security Plan and Incident Reporting Protocol.
• Conduct an IT vulnerability assessment of three platforms and produce a vulnerability report.
• Engage LAS technical teams and platform administrators for review and remediation actions.
• Provide monthly security updates to the Program Manager and flag risks.
• Verify remediation: ensure Critical and High findings are resolved.

Skills

Security risk management

Team leadership

Digital security reviews

Stakeholder coordination

Education

CPP / CEH / CompTIA Security+ or equivalent

Job description

Security and Operational Risk Consultancy

Title: Security and Operational Risk Consultancy (Organization/ Individual)

Organization: Legal Aid Society (LAS)

Location: Islamabad, with travel to Karachi and programme districts in Punjab and Sindh

Position Type: Consulting Assignment (Contractual)

Duration: 12 months from the date of contract signing

Reporting Line: Program Manager

BACKGROUND

The Legal Aid Society (LAS) is a Karachi-based non-profit organisation that provides free legal aid, strengthens justice sector institutions and advocates for access to justice in Pakistan.

LAS is implementing a multi-year access to justice programme on fair trial standards across Punjab, Sindh and Islamabad Capital Territory, together with national and international partner organisations. The programme combines legal representation, capacity building of justice sector actors, research and advocacy, and community engagement.

Programme staff, lawyers, partners and beneficiaries work on sensitive criminal justice matters in a complex operating environment. Safe and uninterrupted delivery depends on robust security risk management, secure information systems and sound operational readiness, including effective coordination with relevant institutions and stakeholders.

To support this, LAS requires the services of an experienced Islamabad-based firm to provide security risk management and operational readiness support during the first year of the programme, and to assess security practices across LAS as an organisation.

OBJECTIVES OF THE ASSIGNMENT

The objectives of this consultancy are: (i) to finalise a Programme Security Plan and Incident Reporting Protocol covering in-person event safety, online programme security, staff emergency procedures and contingency arrangements; and (ii) to conduct an IT vulnerability assessment of the three information platforms used in programme delivery (case management system, Enterprise Resource Planning software and the programme digital helpline) and produce an IT Vulnerability Assessment Report.

SCOPE OF WORK AND EXPECTED DELIVERABLES

The consultant will undertake the following tasks:

A. Programme Security Risk Assessment and Plan

• Finalise the programme Security Plan, covering in-person event safety, safe movement and field travel protocols, online programme security, staff emergency procedures and contingency arrangements.
• Finalise the Incident Reporting Protocol, defining incident categories, escalation thresholds, reporting templates, documentation standards and response timelines.
• Deliver security induction for programme staff, covering key protocols, safe movement procedures and emergency response steps.
• Conduct a mid-term review of the Security Plan (at approximately Month 6) to assess any material changes in the operating environment and update the plan accordingly.
• Provide brief monthly security situation updates to the Program Manager throughout the assignment, flagging emerging risks and advising on any adjustments required.

B. IT Vulnerability and Platform Security Assessment

• Conduct a targeted vulnerability assessment of the three information platforms used in programme delivery: the case management system, the Enterprise Resource Planning software and the programme digital helpline. The assessment will cover access controls, data storage and transmission security, user authentication and configuration vulnerabilities relevant to the sensitivity of programme data.
• Engage LAS technical teams and relevant platform administrators to review current configurations, understand any prior assessments and identify remediation actions already underway.
• Produce an IT Vulnerability Assessment Report documenting findings by severity level (Critical, High, Medium, Low), with a prioritised remediation plan.
• Verify remediation: confirm that all Critical and High findings are resolved

Note: The total duration of this consultancy will be 08-12 months from the date of contract signing.
A detailed work plan with deliverable milestones will be finalised within the first month of the assignment.

REQUIRED QUALIFICATIONS AND EXPERIENCE

The consultant should meet the following minimum criteria:

• A registered firm or an experienced individual consultant with at least 5 years of standing in Pakistan in security risk management or related consultancy.
• A team lead with at least 10 years of experience in security risk management, including advising non-profit, development or human rights organisations in high-risk environments.
• Established professional networks with public institutions in Islamabad and the provinces, and proven experience supporting organisations with operational and administrative requirements.
• Familiarity with international donor standards on duty of care, security and data protection.
• Capacity to maintain strict confidentiality and to apply a do-no-harm approach to sensitive information.
• Demonstrated capacity to conduct basic digital security reviews, including familiarity with access control standards, data protection requirements and platform-level security assessment methodology
• An office or established presence in Islamabad.
• Demonstrated capacity to conduct basic digital security reviews of web-based or cloud-hosted platforms, including familiarity with common vulnerability assessment methodologies.
• Relevant professional certification in security risk management or information security (such as CPP, CEH, CompTIA Security+ or equivalent) is an added advantage.

Reporting and Coordination

The firm will report directly to the Program Manager, Legal Aid Society, and will coordinate closely with the programme security focal person, the Head of Litigation, and the IT, Administration and Finance departments for guidance and progress validation.

Deliverable Description Due Date % of payment to be release

Inception Report Inception plan confirming understanding of scope, approach and work plan for the assignment Month 1 10%

Programme Security Plan Finalised Security Plan covering in-person event safety, safe movement and field travel, online programme security, staff emergency procedures and contingency arrangements Month 2 20%

Incident Reporting Protocol Protocol defining incident categories, escalation thresholds, reporting templates, documentation standards and response timelines Month 2 10%

Staff Security Induction One-time security induction delivered to programme staff covering key protocols, emergency response and safe movement procedures Month 3 10%

IT Vulnerability Assessment Report Findings across the LAS case management system, ERP and programme digital helpline, categorised by severity (Critical, High, Medium, Low) with a prioritised remediation plan Month 4 25%

Remediation Verification Sign-off Written confirmation to the Program Manager that all Critical and High findings are resolved before platforms go live Month 5-6 10%

Mid-term Security Plan Review Updated Security Plan reflecting any material changes in the operating environment Month 6-7 15%

CONFIDENTIALITY AND OWNERSHIP

All data, documents and materials collected or produced under this consultancy, including security assessments, plans and information on staff, partners, beneficiaries and systems, shall remain the exclusive property of the Legal Aid Society. The firm must treat all information as strictly confidential, use it solely for the purposes of this assignment, sign a non-disclosure agreement, and return or securely destroy all LAS information at the end of the assignment.

PAYMENT TERMS

Payment will be made in installments linked to deliverables approved by LAS, as per the deliverables schedule above, the agreed contract terms and applicable financial policies.