Senior Information Security GRC & Compliance Lead

Szabist Isb; Karachi Division; On-site; PKR 2,500,000 - 4,200,000; Full time

Job summary

EFU Life Assurance Ltd. invites applications for a Deputy Manager specializing in Information Security Governance, Risk, and Compliance (GRC).

The role drives the organization’s cybersecurity framework with focus on regulatory compliance and risk management across infrastructure, data, and operations. The ideal candidate has at least eight years in information security and GRC, leads a team of 10, and steers audits, VAPT, and awareness programs to strengthen overall security posture and

Qualifications

• 8+ years of information security experience and GRC leadership.
• Experience managing a team of 10 professionals.
• Familiarity with ISO 27001:2022, ISO 9001 and SECP standards.

Responsibilities

• Develop and maintain Information Security Governance framework with policies, standards, and procedures.
• Drive regulatory compliance with ISO 27001:2022, ISO 9001, SECP regulations and related frameworks.
• Oversee internal and external audits, certifications, and regulatory reporting.
• Lead enterprise risk assessment, vulnerability management, and VAPT across systems.
• Manage 24/7 security monitoring and incident response via SOC/EDR/SIEM/Cyber Command teams.
• Ensure timely incident management and root-cause analysis of security findings.
• Oversee third-party/vendor security assessments and ensure contractual controls.
• Support data protection, privacy, business continuity, and disaster recovery initiatives.
• Lead security awareness programs for executives and staff; prepare risk/compliance reports for governance forums.
• Provide leadership to a 10-person information security team to meet security objectives.

Skills

Information security

GRC

Leadership

Regulatory compliance

Audit & certification

Risk management

Cyber security monitoring

Tools

SIEM

EDR

SOC

Job description

EFU Life Assurance Ltd. invites applications for a Deputy Manager specializing in Information Security Governance, Risk, and Compliance (GRC).

The role drives the organization’s cybersecurity framework with focus on regulatory compliance and risk management across infrastructure, data, and operations. The ideal candidate has at least eight years in information security and GRC, leads a team of 10, and steers audits, VAPT, and awareness programs to strengthen overall security posture and