Sr. Manager

Department & Function: BSS & IT Infrastructure

Position: Sr. Manager / Manager IT – Governance & Security

Location: Islamabad

Reporting to: Deputy Director IT - Infrastructure & Security

Job Type: Permanent

Job Overview:

• The role is responsible for driving IT governance, compliance, and security across all technology functions. It includes developing and executing IT security strategies, conducting audits and risk assessments, and ensuring robust mitigation measures. The position oversees security projects, business continuity planning, and the adoption of next-generation security solutions. Additionally, it provides leadership to the IT Security team while ensuring alignment of policies with regulatory, corporate, and industry standards.

Job Responsibilities:

IT Governance

• Align IT governance principles with overall corporate governance frameworks, Government of Pakistan requirements, and Parent Company policies.
• Provide oversight and reporting to senior management and the board on IT value delivery, risk posture, and performance.
• Guide decision-making on major IT and digital initiatives to ensure alignment with business strategy and regulatory obligations.
• Promote transparency, accountability, and ethical use of IT, AI, and emerging technologies.

Security Governance and Assurance

• Define and enforce IT governance and security frameworks, policies, processes, and standards across all IT domains.
• Establish baseline security controls, ensure regular reviews, and align them with regulatory and corporate requirements.
• Develop executive level dashboards and compliance reporting to provide visibility into risk posture and progress.

Cloud Security and Compliance

• Design and manage governance frameworks for multi-cloud environments, ensuring secure deployments and adherence to Pakistan's Cloud First Policy, other National directives, Parent Company policies, and global best practices.
• Collaborate with enterprise-wide IT teams to embed security and governance.
• Automate compliance monitoring and reporting using policy as code and infrastructure as code approaches.

Risk and Audit Management

• Conduct enterprise-wide IT risk assessments, maintain risk registers, and implement mitigation plans.
• Lead IT related internal, external, Parent Company audits, ensuring evidence is available and findings are resolved on time.
• Continuously improve governance and compliance programs to remain aligned with evolving threats, business priorities, and regulations.
• Ensure compliance with PTA (including CTDISR), SECP, SBP, and other Government of Pakistan regulations, as well as Parent Company guidelines and relevant international standards.

Security Operations and Controls

• Oversee deployment and management of key security controls, including Identity and Access Management (IAM), Privileged Access Management (PAM), Email Security Gateway (ESG), endpoint protection, Web Application Firewalls (WAF), network firewalls, and vulnerability management.
• Implement modern security models such as Zero Trust and ensure continuous monitoring of IT and cloud environments.
• Leverage AI-driven monitoring and analytics for anomaly detection, predictive threat intelligence, and real-time risk management.

Incident Response and Operational Resilience

• Develop, maintain, and test incident response frameworks compliant with regulatory and Parent Company requirements.
• Lead cross-functional teams during incidents and provide clear, timely communication to senior stakeholders.
• Conduct post-incident reviews and embed lessons learned into governance and operational practices.

Business Continuity and Disaster Recovery

• Design, implement, and maintain Business Continuity and Disaster Recovery programs for critical services, aligned with regulatory, Parent Company, and international standards.
• Conduct Business Impact Analyses (BIAs), ensure RTO and RPO compliance, and regularly test recovery strategies.
• Use AI-enabled simulations to assess readiness and strengthen recovery effectiveness.

Vendor and Third-Party Risk Governance

• Embed governance and security requirements in vendor and partner contracts, aligned with PTA and Government of Pakistan cybersecurity standards.
• Ensure vendors and partners adhere to organizational, regulatory, and Parent Company governance standards.
• Conduct third-party risk assessments, monitor remediation activities, and track ongoing compliance.
• Ensure outsourced and partner-operated services consistently meet governance and security requirements.

Leadership and Stakeholder Engagement

• Lead and mentor the IT Governance and Security team, building capability, innovation, and resilience.
• Foster a security-first and compliance-driven culture that promotes accountability and responsible innovation.
• Act as the key liaison with executives, regulators, auditors, and the Parent Company.

Qualification:

• Must have a Bachelor's degree preferably in Information Security, Computer Science, IT, or a related field.

Experience:

• Must have 4+ years progressive experience in IT Governance, Security, or Risk Management
• Preferred: Experience in cloud governance, multi-cloud security, and hybrid IT environments.
• Proven use of automation and AI-enabled governance, monitoring, and threat detection solutions.
• Professional certifications preferred: CISSP, CISM, CISA, CRISC, ISO 27001 Lead Auditor/Implementer, ITIL.
• Track record in managing audits, regulatory compliance programs, and enterprise-wide risk initiatives.