Assistant Manager Information Security - Risk Management & Compliance

The Assistant Manager Information Security - Risk Management & Compliance will play a pivotal role in advancing the organization's Security Governance, Risk, and Compliance (GRC) program. This position focuses on implementing and maintaining security policies and controls aligned with global standards such as ISO, CIS, and NIST. The role involves planning and executing security enhancements, vulnerability assessments, penetration testing, and risk assessments to ensure both preventive and reactive security measures are effectively in place. The successful candidate will work closely with various teams to strengthen the overall security posture and support compliance objectives.

Key Responsibilities

- Analyze and recommend security controls for systems, web applications, and mobile applications. Develop security strategies to meet information risk compliance goals within set deadlines.
- Oversee, plan, and execute vulnerability audits, penetration tests, forensic IT audits, and related investigations. Ensure findings are integrated into projects to enhance the organization’s IT security framework.
- Provide expert advice on security solutions tailored to emerging threats, improving the security architecture of the network.
- Collaborate cross-functionally to promote governance goals and uphold information management lifecycle standards and best practices for both physical and electronic information.
- Support and maintain strong business relationships with internal and external security auditors and regulatory bodies.
- Assist internal teams in aligning their programs with the overall security control framework to ensure successful implementation.
- Plan and conduct business risk assessments, internal and external vulnerability assessments, and penetration testing of critical business applications.
- Manage the annual security assessment plan, identifying vulnerabilities and driving their resolution.

Required Qualifications

- Bachelor’s degree, preferably in Computer Science or Engineering.
- Approximately 7 years of overall technology experience, with a focus on information security.

Preferred Skills and Technical Expertise

- Proficient in network penetration testing, including OWASP Top 10, Android/iOS application assessments, API penetration testing, red teaming, adversary simulation, and source code/static application security testing (SAST).
- Experience with NIST SP 800-115 penetration testing methodologies, including reporting with executive summaries, technical findings, CVSS scoring, evidence documentation, and remediation recommendations.
- Skilled in retesting and remediation validation processes.
- Hands-on experience with security tools such as Burp Suite, Nmap, Metasploit, Nessus/Tenable, Qualys, Wireshark, Kali Linux, OWASP ZAP, Nikto, SQLMap, and scripting for automation.

This is a permanent position based in Islamabad, reporting to the Senior Manager of Information Security - Governance & Architecture. The role demands a proactive individual capable of managing complex security challenges while ensuring compliance with international standards.