Senior IT & Operational Risk Manager (ERM & InfoSec)

SSGC LPG Limited; Karachi Division; On-site; PKR 2,500,000 - 6,000,000; Full time

Job summary

Sui Southern Gas Company Limited is seeking an Engineering candidate with strong risk management and information security experience to implement the Enterprise Risk Management framework across IT and Operations/Technical departments.

Requirements include an engineering degree or equivalent, PEC registration, and experience with ISO 2700X. Certifications like CISA/CRISC/CISSP are preferred; ISO 31000 training is a plus.

Qualifications

• Engineering degree in Mechanical or Electrical with 9+ years of relevant experience, or BCS with 10+ years of relevant experience.
• Registration with PEC is mandatory for Engineers.
• Preferred certifications: CISA, CRISC, CISSP, etc.
• Training in ISO 31000 on risk management will be a plus.

Responsibilities

• Establishes and communicates the organization’s Enterprise Risk Management Framework and guidance for ERM maturity.
• Implements ERM Framework, risk culture and policies; advises Executive Management on risk appetite and limits.
• Designs and facilitates Enterprise Risk Management methodologies, tools, and techniques across the organization.
• Monitors enterprise-wide risk assessments and priority risks.
• Leads system-wide information security risk management and ISO 2700X compliance initiatives.
• Develops IT risk metrics, BIA, and risk management framework governance.
• Assesses security controls and risk for IT systems; advises on risk treatment.
• Leads IT risk compliance programs and regulatory alignment across departments.
• Coordinates and tracks operational, IT risks and security assessments; maintains documentation.

Skills

Information security

Audit

Risk management

Compliance

Risk consulting

ISO 2700X

ISO 31000

Education

Engineering degree (Mech/Elec)

BCS or equivalent

Job description

Sui Southern Gas Company Limited is seeking an Engineering candidate with strong risk management and information security experience to implement the Enterprise Risk Management framework across IT and Operations/Technical departments.

Requirements include an engineering degree or equivalent, PEC registration, and experience with ISO 2700X. Certifications like CISA/CRISC/CISSP are preferred; ISO 31000 training is a plus.