Deputy Director (Governance, Risk Assessment & Compliance) - Lahore Region (Contractual)

The National Database and Registration Authority (NADRA) is seeking a qualified professional for the position of Deputy Director (Governance, Risk Assessment & Compliance) on a contractual basis, located at the Lahore Chamber. This role requires a dynamic individual with extensive experience in governance, risk management, and compliance within the information security domain. The ideal candidate will lead efforts to ensure adherence to international standards and internal policies, driving risk mitigation and compliance initiatives to safeguard organizational assets. The position is open to candidates up to 44 years of age, with applications accepted online until October 25, 2026.

Key Responsibilities:
- Lead and ensure compliance with ISO 27001, ISO 27701, ISO 22301, NIST, and CIS Controls frameworks.
- Stay abreast of the latest security best practices and technologies, supporting security assessments and compliance activities.
- Formulate and maintain Information Security Policies, Standard Operating Procedures (SOPs), and related documentation.
- Develop and implement controls related to Responsible AI, including Explainability, Model Risk Management, Bias Detection, and Privacy Preservation.
- Apply comprehensive knowledge of information security principles, threat landscapes, vulnerabilities, and attack vectors to support risk management and security controls.
- Conduct risk assessments, including risk identification, analysis, and mitigation strategies.
- Manage the incident response cycle, generate incident reports, and utilize Security Orchestration, Automation, and Response (SOAR) technologies to support Security Operations Center (SOC) functions.
- Work with Endpoint Protection Platform (EPP) and Endpoint Detection and Response (EDR) solutions.
- Deliver information security training to diverse audiences, both technical and non-technical.
- Operate independently, lead teams effectively, and serve as a liaison between senior management and team members.
- Communicate security and compliance information clearly to technical teams and senior leadership.

Required Qualifications:
- Bachelor’s degree (4 years) in Computer Science, Information Technology, Cyber Security, Information Security, Data Science, Artificial Intelligence, or a related field from an HEC-recognized university.
- All degrees must be attested by the Higher Education Commission (HEC).
- A minimum of 6 to 10 years of post-graduation professional experience, including at least 3 years in governance, risk management, and compliance roles.

Preferred Qualifications and Certifications:
- Certifications such as ISO 27001 Lead Implementer/Auditor, Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), and Certified Information Systems Security Professional (CISSP) are highly desirable.

Additional Information:
- The selected candidate will undergo a probation period of six months, which may be extended based on performance.
- Government or semi-government employees must provide a No Objection Certificate (NOC) at the time of the interview.
- Attested educational documents from HEC or the relevant regulatory body are required upon joining.
- Medical fitness and character certificates must be submitted by the selected candidate.
- The recruitment process may be canceled or modified at management’s discretion without prior notice.
- Only shortlisted candidates will be contacted for tests and interviews.
- False information at any stage will lead to disqualification.
- No travel allowance or daily allowance will be provided for test or interview attendance.
- Electronic devices such as mobile phones and smartwatches are prohibited during the test and interview.
- NADRA encourages applications from females, minorities, transgender individuals, and differently-abled candidates.
- Five years of general age relaxation is included in the stated age limit.

Interested candidates must apply online through NADRA’s official careers portal by October 25, 2026. Applications submitted through any other means will not be considered.