Manager - Information Security

About the role

The Manager - Information Security leads the development and implementation of information security strategies, policies and procedures to protect the bank's information assets and technology infrastructure. The role manages security risks through controls, threat analysis, vulnerability assessments and security simulations, builds a security-conscious culture through stakeholder engagement, talent development and awareness training, and ensures compliance with statutory, regulatory and contractual requirements.

Key responsibilities

• Contribute to the bank's information security strategy and implement its roadmap
• Develop and maintain security governance frameworks, policies, procedures and guidelines
• Implement policy, procedural and process-level controls to safeguard information assets
• Drive continuous improvement of security policies and processes, considering cost reduction and productivity gains
• Oversee periodic information security reviews aligned with the annual security plan
• Coordinate IT security audits, application security assessments and vulnerability tests with internal and external parties
• Ensure timely compliance with statutory, regulatory and contractual requirements
• Monitor and update security metrics (KRI and KPI) monthly and report to the Information Security Committee and management
• Run a third-party and vendor risk management programme, including vendor risk assessments
• Analyse security alerts, resolve security incidents with root cause analysis and preventive measures, and keep the ISC and management informed of threats and vulnerabilities
• Lead enterprise-wide risk management and conduct security risk assessments
• Build a high-performance security team, including recruitment and retention

Required profile

• Minimum of 06 years of work experience, including at least 03 years in information security or cyber security at Assistant Manager level or above
• Bachelor's degree in Cyber Security, Computer Science or a related field; a Master's degree is an added advantage
• Mandatory professional certification in information security such as CISSP, CISM, CRISC, GIAC or equivalent

Required skills

• Security governance and compliance
• Vulnerability management
• Security architecture and design
• Threat intelligence and analysis
• Security operations and monitoring