Unit Head IS GRC

U Microfinance Bank Limited; Islamabad; On-site; PKR 4,000,000 - 6,000,000; Full time

Job summary

U Microfinance Bank Limited is seeking an experienced Unit Head Information Security GRC to establish and lead the Governance, Risk and Compliance function. The role ensures alignment of the information security program with business objectives, regulatory requirements and industry best practices.

You will oversee risk assessments, compliance activities, policy governance and control assurance across the bank, collaborating with IT, Risk Management, Compliance and Internal Audit.

Qualifications

• Bachelor’s degree in computer science, IT, information security or related discipline; Master’s degree preferred.
• Minimum 10 years of progressive experience in Information Security with strong GRC expertise.
• At least 3–5 years in a managerial or leadership role; banking/financial sector experience preferred.
• Certifications: CISM, CISSP, CISA, CRISC, ISO 27001 Lead Auditor/Lead Implementer.

Responsibilities

• Develop and maintain the Bank's Information Security Governance framework, policies, standards and procedures.
• Lead the information security risk management program, including risk assessments and remediation tracking.
• Ensure compliance with SBP regulations, ISO 27001, and other regulatory requirements.
• Oversee information security compliance assessments and evaluation of control effectiveness.
• Coordinate information security reviews, regulatory inspections and independent assessments; close observations promptly.
• Manage third-party and outsourcing risk assessments and oversight of vendors.
• Monitor cybersecurity risks, control deficiencies and remediation activities; escalate significant issues to senior management.
• Create cybersecurity risk and compliance dashboards and KRIs for senior management.
• Develop and oversee Bank-wide information security awareness and training, including phishing simulations.
• Ensure information security requirements are integrated into technology projects and major initiatives.
• Lead the GRC team and drive ongoing governance, risk management and compliance improvements.

Skills

Information Security Governance

ISO 27001/27002

Risk management

IT audit & compliance

Third-party risk management

Education

Bachelor’s degree in Computer Science/IT/Information Security

Master’s degree preferred

Job description

Purpose of Job

The Unit Head Information Security GRC is responsible for establishing, managing and continuously improving the Bank's Information Security Governance, Risk and Compliance function. The role ensures that the Bank's information security program remains aligned with business objectives, risk appetite, regulatory requirements and industry best practices.

The position provides oversight of information security risks, regulatory compliance, governance frameworks, policies, audit matters and security control assurance. It works closely with business units, IT, Risk Management, Compliance, Internal Audit and external stakeholders to ensure effective implementation and monitoring of the Bank's information security requirements.

The role also provides management with visibility into the Bank's cybersecurity risk posture, control effectiveness, compliance status and areas requiring remediation or management intervention.

Key Responsibilities

• Develop and maintain the Bank's Information Security Governance framework, policies, standards and procedures.
• Lead the information security risk management program, including risk assessments, risk register maintenance, risk treatment and remediation tracking.
• Ensure compliance with applicable SBP regulations, cybersecurity advisories, ISO 27001 and other relevant regulatory and industry requirements.
• Oversee periodic information security compliance assessments and evaluate the effectiveness of security controls across the Bank.
• Coordinate information security reviews, regulatory inspections and independent assessments, ensuring timely closure of observations.
• Oversee information security risk assessments of third-party service providers, vendors and outsourcing arrangements.
• Monitor cybersecurity risks, control deficiencies, policy exceptions and remediation activities, escalating significant issues to the CISO and relevant management forums.
• Develop management-level cybersecurity risk and compliance dashboards, KRIs and periodic reports for senior management.
• Develop and oversee the Bank-wide Information Security Awareness and Training Program, including awareness campaigns, phishing simulations and effectiveness assessments
• Ensure information security requirements are incorporated into technology projects, system acquisitions and major business initiatives.
• Lead the GRC team, establish performance objectives and drive continuous improvement in governance, risk management and compliance practices.

Technical Skills

• Strong knowledge of Information Security Governance, Risk and Compliance.
• ISO 27001/27002 and ISMS implementation.
• Information security risk assessment and management.
• IT audit, compliance assessments and control assurance.
• Third-party and outsourcing risk management.
• Knowledge of NIST CSF, COBIT, ISO 27005, PCI DSS and other relevant frameworks.
• Understanding of infrastructure, network, application, access management and security operations controls.

Soft Skills

• Leadership and team management.
• Analytical and critical thinking.
• Strategic planning and decision-making.
• Stakeholder management and communication.
• Problem-solving and risk-based judgment.

Experience & Qualification

• Bachelor’s degree in computer science, IT, Information Security or a related discipline. Master's degree preferred.
• Minimum 10 years of progressive experience in Information Security, with strong expertise in Governance, Risk and Compliance.
• At least 3–5 years in a managerial or leadership role.
• Banking or financial sector experience preferred.
• CISM, CISSP, CISA, CRISC, ISO 27001 Lead Auditor or Lead Implementer.