Senior Manager Security Assurance

Mashreq Careers; Pakistan; On-site; PKR 4,500,000 - 8,000,000; Full time

Job summary

Mashreq Careers in Pakistan seeks a Senior Manager of Information Security to lead strategic security initiatives across the organization. You will oversee secure SDLC integration, vulnerability management, and advanced threat mitigation while guiding a high-performing security team and collaborating with senior stakeholders.

You will drive security governance, ensure compliance with NIST 800-53, NIST CSF and OWASP standards, and communicate security posture to executive leadership with clear,

Qualifications

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• 8–12 years of information security experience with leadership roles.
• Two advanced security certifications such as CISSP, CISM, CISA, GCED, CeH, or Azure Security.
• Proven SDLC security program experience and large-scale security initiatives.
• Deep knowledge of vulnerability management, penetration testing, and app security assessments.
• Strong knowledge of NIST 800-53, NIST CSF, and OWASP.
• Proficiency in networking, OS, and application development.
• Excellent communication and stakeholder management.

Responsibilities

• Strategically lead and manage vulnerability management and application security programs.
• Oversee the integration of security practices within the SDLC with development and operations teams.
• Expert in DevSecOps with automation and compliance tools.
• Plan, coordinate, and manage annual penetration testing activities across all applications.
• Lead and mentor a team of security professionals.
• Conduct and oversee IT compliance assessments per NIST 800-53 and NIST CSF.
• Certify and approve technical platforms post-security reviews.
• Monitor and analyze threat landscape with strategic mitigation plans.
• Evaluate and implement advanced security solutions and tools.
• Collaborate with executive leadership on information security strategies.
• Communicate and coordinate with stakeholders on security initiatives.
• Prepare and present security reports to senior management and governance committees.

Skills

Strategic leadership

Vulnerability management

Application security

DevSecOps

Threat analysis

Security governance

Team leadership

Security reporting

Education

Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field

Job description

Job Purpose:

We are looking for a dynamic and experienced Senior Manager of Information Security to lead our security initiatives, focusing on secure software development lifecycle (SDLC) and strategic leadership. The ideal candidate will have a strong background in managing complex security programs, leading teams, and ensuring robust security practices across the organization. This role demands a visionary leader who can drive security excellence while effectively managing resources and collaborating with senior stakeholders.

Key Responsibilities for the Role

• Strategically lead and manage the organization's vulnerability management and application security programs, ensuring comprehensive identification, analysis, and remediation of security risks.
• Oversee the integration of security practices within the SDLC, collaborating with development and operations teams to ensure secure and compliant application development and deployment.
• Expert in DevSecOps, integrating security practices throughout the SDLC with automation and compliance tools to enhance code integrity and data protection.
• Plan, coordinate, and manage annual penetration testing activities across all applications being used in MBPL, ensuring thorough coverage and effective risk mitigation.
• Lead and mentor a team of security professionals, fostering a culture of excellence, continuous learning, and proactive security awareness.
• Conduct and oversee IT compliance assessments and reviews, ensuring adherence to industry standards such as NIST 800-53 and the NIST Cybersecurity Framework.
• Certify and approve technical platforms post-security reviews, ensuring all systems are secure and resilient against emerging threats.
• Monitor and analyze the organization's threat landscape, developing strategic mitigation plans and ensuring effective monitoring and reporting mechanisms are in place.
• Evaluate and implement advanced security solutions and tools, ensuring the organization's security infrastructure remains robust and up-to-date.
• Collaborate with executive leadership to develop and implement comprehensive information security strategies aligned with organizational goals and objectives.
• Communicate and coordinate with various stakeholders to ensure transparency and alignment in security initiatives and compliance efforts.
• Prepare and present detailed security reports and recommendations to senior management and governance committees.

Key Principles:

• Strategic Leadership: Provide strategic leadership in integrating security into the Software Development Life Cycle (Secure SDLC) and managing vulnerability programs, ensuring alignment with organizational objectives.
• Empowering Teams: Empower and support team members in their roles, promoting a culture of accountability, innovation, and excellence in security practices.
• Holistic Security View: Adopt a holistic approach to security, considering the full spectrum of vulnerabilities, threats, and mitigation strategies in the organization’s security posture.
• Stakeholder Engagement: Engage effectively with stakeholders across the organization, ensuring that security priorities are communicated, understood, and supported at all levels.

Qualifications:

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or a related field.
• 8 to 12 years of extensive experience in information security, with significant experience in leadership and team management roles.
• Minimum of two advanced security certifications such as CISSP, CISM, CISA, GCED, CeH, or Azure Security.
• Proven experience in developing and managing secure SDLC processes and large-scale security programs.
• Deep understanding of vulnerability management, penetration testing methodologies, and application security assessments (SAST, DAST, IAST).
• Strong knowledge of security frameworks, standards, and compliance requirements, including NIST 800-53, the NIST Cybersecurity Framework and OWASP.
• Proficiency in security technologies and tools, as well as a solid understanding of networking, operating systems, and application development.
• Demonstrated leadership abilities with experience in building and leading high-performing security teams.
• Exceptional communication, negotiation, and interpersonal skills, with the ability to influence and engage stakeholders at all levels.
• Strong strategic thinking and problem-solving skills with a focus on proactive and innovative security solutions.
• Experience in cybersecurity risk management and developing organizational security strategies.

Preferred Skills:

• Experience in the banking or financial services sector.
• Familiarity with cloud security architectures and services.
• Proven track record in managing cybersecurity incidents and responses.
• Experience in budgeting and resource allocation for security programs.

Problem Solving:

• Holistic Security Problem Solving: Approach security problems with a holistic perspective, considering the broader impact on the organization and ensuring that solutions align with business objectives.
• Leadership in Crisis: Lead the organization through security crises, providing clear direction and making decisive, informed decisions under pressure to mitigate risks.
• Innovative Solutions: Drive innovation in solving security challenges, exploring new technologies, methodologies, and approaches to stay ahead of emerging threats.
• Balancing Priorities: Solve problems by balancing immediate security needs with long-term strategic goals, ensuring that solutions are sustainable and support the organization’s growth.
• Mentorship and Development: Mentor and develop team members’ problem-solving abilities, fostering a proactive and innovative mindset within the security team.