Senior Manager Security Assurance

Mashreqbank PSC; Pakistan; On-site; PKR 4,000,000 - 8,000,000; Full time

Job summary

Mashreqbank PSC is seeking a dynamic Senior Manager of Information Security to lead our security initiatives, focusing on secure software development lifecycle and strategic leadership. The role demands a visionary leader who can drive security excellence while effectively managing resources and collaborating with senior stakeholders.

The candidate will strategically guide vulnerability management and application security programs, integrate security into the SDLC with DevSecOps, and oversee

Qualifications

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related field.
• 8 to 12 years of extensive experience in information security, with significant leadership experience.
• Minimum of two advanced security certifications such as CISSP, CISM, CISA, GCED, CeH, or Azure Security.
• Proven experience in developing and managing secure SDLC processes and large-scale security programs.
• Deep understanding of vulnerability management, penetration testing methodologies, and application security assessments (SAST, DAST, IAST).
• Strong knowledge of security frameworks, standards, and compliance requirements, including NIST 800-53, NIST CSF and OWASP.

Responsibilities

• Strategically lead and manage vulnerability management and application security programs.
• Oversee integration of security practices within the SDLC with DevOps teams.
• Lead DevSecOps initiatives with automation and compliance tooling.
• Plan and coordinate annual penetration testing across all MBPL applications.
• Mentor and lead a team of security professionals.
• Conduct IT compliance assessments per industry standards.

Skills

Strategic leadership

Team leadership

Stakeholder management

Communication

Education

Bachelor or Master in CS/Info Security

Tools

NIST 800-53

OWASP

DevSecOps tooling

Job description

Job Purpose:

We are looking for a dynamic and experienced Senior Manager of Information Security to lead our security initiatives, focusing on secure software development lifecycle (SDLC) and strategic leadership. The ideal candidate will have a strong background in managing complex security programs, leading teams, and ensuring robust security practices across the organization. This role demands a visionary leader who can drive security excellence while effectively managing resources and collaborating with senior stakeholders.

Key Responsibilities for the Role

• Strategically lead and manage the organization's vulnerability management and application security programs, ensuring comprehensive identification, analysis, and remediation of security risks.
• Oversee the integration of security practices within the SDLC, collaborating with development and operations teams to ensure secure and compliant application development and deployment.
• Expert in DevSecOps, integrating security practices throughout the SDLC with automation and compliance tools to enhance code integrity and data protection.
• Plan, coordinate, and manage annual penetration testing activities across all applications being used in MBPL, ensuring thorough coverage and effective risk mitigation.
• Lead and mentor a team of security professionals, fostering a culture of excellence, continuous learning, and proactive security awareness.
• Conduct and oversee IT compliance assessments and reviews, ensuring adherence to industry standards such as NIST 800-53 and the NIST Cybersecurity Framework.
• Certify and approve technical platforms post-security reviews, ensuring all systems are secure and resilient against emerging threats.
• Monitor and analyze the organization's threat landscape, developing strategic mitigation plans and ensuring effective monitoring and reporting mechanisms are in place.
• Evaluate and implement advanced security solutions and tools, ensuring the organization's security infrastructure remains robust and up-to-date.
• Collaborate with executive leadership to develop and implement comprehensive information security strategies aligned with organizational goals and objectives.
• Communicate and coordinate with various stakeholders to ensure transparency and alignment in security initiatives and compliance efforts.
• Prepare and present detailed security reports and recommendations to senior management and governance committees.

Key Principles:

• Strategic Leadership: Provide strategic leadership in integrating security into the Software Development Life Cycle (Secure SDLC) and managing vulnerability programs, ensuring alignment with organizational objectives.
• Empowering Teams: Empower and support team members in their roles, promoting a culture of accountability, innovation, and excellence in security practices.
• Holistic Security View: Adopt a holistic approach to security, considering the full spectrum of vulnerabilities, threats, and mitigation strategies in the organization’s security posture.
• Stakeholder Engagement: Engage effectively with stakeholders across the organization, ensuring that security priorities are communicated, understood, and supported at all levels.

Qualifications:

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related field.
• 8 to 12 years of extensive experience in information security, with significant experience in leadership and team management roles.
• Minimum of two advanced security certifications such as CISSP, CISM, CISA, GCED, CeH, or Azure Security.
• Proven experience in developing and managing secure SDLC processes and large-scale security programs.
• Deep understanding of vulnerability management, penetration testing methodologies, and application security assessments (SAST, DAST, IAST).
• Strong knowledge of security frameworks, standards, and compliance requirements, including NIST 800-53, the NIST Cybersecurity Framework and OWASP.
• Proficiency in security technologies and tools, as well as a solid understanding of networking, operating systems, and application development.
• Demonstrated leadership abilities with experience in building and leading high-performing security teams.
• Exceptional communication, negotiation, and interpersonal skills, with the ability to influence and engage stakeholders at all levels.
• Strong strategic thinking and problem-solving skills with a focus on proactive and innovative security solutions.
• Experience in cybersecurity risk management and developing organizational security strategies.

Preferred Skills:

• Experience in the banking or financial services sector.
• Familiarity with cloud security architectures and services.
• Proven track record in managing cybersecurity incidents and responses.
• Experience in budgeting and resource allocation for security programs.

Problem Solving:

• Holistic Security Problem Solving: Approach security problems with a holistic perspective, considering the broader impact on the organization and ensuring that solutions align with business objectives.
• Leadership in Crisis: Lead the organization through security crises, providing clear direction and making decisive, informed decisions under pressure to mitigate risks.
• Innovative Solutions: Drive innovation in solving security challenges, exploring new technologies, methodologies, and approaches to stay ahead of emerging threats.
• Balancing Priorities: Solve problems by balancing immediate security needs with long-term strategic goals, ensuring that solutions are sustainable and support the organization’s growth.
• Mentorship and Development: Mentor and develop team members’ problem-solving abilities, fostering a proactive and innovative mindset within the security team.