Assistant Manager Information Security

NBP Fund Management Limited (NBP Funds) is a premier asset management company in Pakistan, managing assets exceeding Rs. 600 billion across a diverse range of investment solutions. Backed by National Bank of Pakistan and Baltoro Growth Fund, the company enjoys strong institutional support and a solid governance framework. With an AM1 rating from PACRA, the highest investment management rating in Pakistan, NBP Funds demonstrates excellence in management, systems, processes, and fund performance. The company manages 26 open-ended mutual funds, 4 pension funds, and various advisory portfolios, all aimed at promoting savings and helping investors achieve their financial objectives nationwide.

Key Responsibilities

- Monitor and evaluate the organization’s IT infrastructure to ensure compliance with established security standards and policies.
- Conduct hands-on penetration testing of web applications, mobile applications (Android/iOS), APIs, network infrastructure, and Active Directory environments.
- Perform vulnerability assessments and other relevant security testing activities.
- Identify, exploit, validate, and document security vulnerabilities following industry standards and approved testing methodologies.
- Execute security testing aligned with OWASP Top 10, OWASP Web Security Testing Guide (WSTG), OWASP API Security Top 10, and applicable mobile security testing standards.
- Analyze and prioritize vulnerabilities based on severity, exploitability, business impact, and exposure. Collaborate with IT teams, developers, and external vendors to ensure timely remediation.
- Conduct social engineering exercises, including phishing campaigns, to simulate real-world attack scenarios and assess employee awareness and organizational defenses.
- Engage with vendors regarding reported third-party vulnerabilities, validating actionable issues and filtering out false positives.
- Deliver security awareness training programs to employees, educating them on best practices and emerging cybersecurity threats.
- Support the Manager Information Security in ongoing activities such as developing, reviewing, implementing, and enforcing information security policies, procedures, standards, and guidelines in line with industry best practices and regulatory requirements.

Required Qualifications

- Bachelor’s or Master’s degree in Cybersecurity, Information Security, Computer Science, or a related field from an HEC-recognized institution.
- Minimum of 3 to 5 years of practical experience in Vulnerability Assessment and Penetration Testing (VAPT), penetration testing, or application security.
- Working knowledge of network protocols, Linux, Windows, Active Directory, HTTP/S, REST APIs, authentication, authorization, and common web technologies.
- Strong understanding of security frameworks, standards, and regulatory requirements.
- Effective communication and interpersonal skills to collaborate across teams and with external partners.

Preferred Qualifications and Certifications

- Possession of recognized VAPT certifications such as OSCP, eWPT, PNPT, CEH Practical, or equivalent is highly desirable.

Location

- Head Office: Karachi
- Department: Information Security

This role offers an excellent opportunity to work within a leading financial institution committed to maintaining the highest standards of information security and risk management. Candidates with a proactive approach to cybersecurity and a passion for protecting organizational assets are encouraged to apply.