Information Security Officer

Job Description: Information Security Officer - GRC

Department: Group Information Security

Branch/Location: HBZ Services Karachi

General Information

• Job Title: Information Security Officer - GRC
• Designation: OG-II
• Job Family: Professional Support Services
• Line Manager Title: Information Security Manager - GRC
• Line Manager’s Manager Title: Chief Information Security Officer

II. Job Purpose

The person will be responsible for assisting in governance, risk and compliance related activities such as security risk assessments covering information & cyber security, and all areas of information technology.

III. Job Dimensions

• Risk / Security Liaison
• Operational Support
• Group Role

IV. Job Requirements

Category Requirement

Academic

Bachelor’s degree or Master’s degree in Computer Science/IT/IS or related fields

Professional

ISC 2 CC, ISACA CSX, Cybersecurity Fundamentals Certificate etc.

Formal Training

Information security related trainings are preferable

Practical Experience

Fresh with minimum or no experience of information security and technology risk experience. Prior experience of Banking or Financial institutions will be highly preferred.

Job Competencies

Functional:

• Expertise to understand the Bank’s technical and business environment.
• Knowledge of commonly used technologies like Databases, Operating Systems, Network, User Management and Security technologies.
• Interact effectively with information security coordinators in countries and IT personnel in Group.
• Knowledge of industry and regulatory framework and standards like NIST, ISO27000 series, and PCI DSS etc.

Behavioural:

• Leadership
• Team Player
• Result oriented
• To work under pressure

V. Job Context

The position requires that the latest IT infrastructure and security related products and allied risk are researched and mitigations techniques available to be evaluated while keeping in view the Bank’s environment.

VI. Job Accountabilities

• Maintain a solid understanding of the bank's environment and assist in ensuring compliance to Information security policies, directives and regulatory requirements & developments internally and externally, in addition to evolving best practice in cyber security risk management.
• Assist in implementing information security controls, framework and program that aligns to regulatory requirements, ensuring documented and sustainable compliance.
• Assist in planning, executing, and reporting on security assessments.
• Assist in in-depth cybersecurity reviews and assessments for the bank’s most important projects and critical business applications.
• Liaise with Group and countries stakeholders to ensure remediation activities are progressing as per timeline.
• Follow up, escalate and report information and cyber security findings with Group and Countries.
• Special Projects: Ad-hoc projects assigned by line manager.

VII. Job Empowerment

• Decisions Expected: None
• Recommendations Expected: * Risk Mitigations
• Security Assessments & classification
• Implementation of Controls to improve IT processes and operations and InfoSec based on Security risk Assessment

Please note, this position is a contract of 6 months*

Depending on performance it *may* progress into a full-time role in the future.