Head of Information Security - Confidential

Our client, a confidential organization based in Lahore, is seeking an experienced Head of Information Security to lead and independently assure the company’s information security, risk, and compliance posture. This role is critical in protecting sensitive data and maintaining the trust of approximately 42 million borrowers and 174 member institutions. The position acts as a business enabler by balancing security with innovation, ensuring safe and defensible pathways for growth. The Head of Information Security will also manage the relationship with the State Bank of Pakistan (SBP) regarding security and risk audits, maintaining independence from IT operations.

Key Responsibilities

Strategy & Business-Enabling Risk Posture:
Develop and implement the vision and strategic direction for the information security, risk, and compliance program aligned with recognized standards such as ISO 27001, NIST, and CIS. Operate with a pragmatic, risk-based approach that supports product innovation and speed to market. Maintain the enterprise risk register and key risk indicators, ensuring risks are visible and decision-ready for management and the Board.

Regulatory Audit & Compliance:
Own the relationship with the State Bank of Pakistan for security and risk audits, managing all aspects of SBP inspections including preparation, evidence collection, response, and timely closure of findings. Lead broader compliance activities and external audits. Ensure adherence to the Credit Bureaus Act 2015, applicable SBP prudential and IT regulations, and data protection requirements for borrower Personally Identifiable Information (PII).

Governance, Framework & Controls:
Design, maintain, and govern the information security policies, frameworks, standards, and controls. Independently assure their effectiveness and drive relevant certifications such as ISO 27001 to demonstrate a best-in-class security posture and support the company’s IPO objectives.

Threat, Incident & Resilience Management:
Plan and manage cyber threat detection and incident response to minimize business impact. Oversee monitoring tools including SIEM and SOAR platforms, breach investigations, and reporting. Collaborate with the Head of IT & Infrastructure to assure business continuity and disaster recovery from a risk and resilience perspective. Own the security tooling strategy, specifying business needs while IT handles implementation.

Assurance, Third Parties & Security Culture:
Conduct Vulnerability Assessment and Penetration Testing (VAPT) on company infrastructure and mobile applications, tracking remediation to closure. Manage third-party and vendor security risks across member institutions, fintech partners, and technology vendors. Work with system owners to maintain compliance with security requirements and foster an enterprise-wide security awareness culture through staff training. Regularly report the security and risk posture to the CEO, management, Board, and relevant committees.

Required Qualifications

- Over 15 years of experience in information security, risk, and compliance, preferably within regulated financial services or data-sensitive environments.
- Proven track record managing regulator audits, with strong preference for experience dealing with the State Bank of Pakistan or comparable financial regulators.
- A pragmatic, business-oriented security leader who balances enabling innovation with managing risk, demonstrating the ability to propose safe and practical solutions rather than defaulting to rejection.
- Strong leadership to uphold material risk positions confidently with management, the Board, and regulators.
- Relevant certifications such as CISSP, CISM, CRISC, and/or ISO 27001 Lead Auditor or Implementer.
- Deep knowledge of security frameworks including ISO 27001, NIST, and CIS, along with incident response expertise.
- Working knowledge of the Credit Bureaus Act 2015 and SBP regulations is advantageous.

This role offers the opportunity to lead a critical function that safeguards a vast and sensitive data ecosystem while enabling business growth and innovation in a highly regulated environment.