Vice President Information Security - GRC

Habib Bank AG Zurich · Karachi division, Pakistan

The Vice President Information Security - GRC is responsible for managing and coordinating the Bank's Information Security Governance, Risk and Compliance activities across the Group. The role supports the implementation of the Group Information Security strategy by ensuring effective governance processes, cyber risk management practices, regulatory compliance, control assurance, and security awareness programs are consistently executed across all countries and subsidiaries.

The position serves as a key liaison between Group Information Security, Technology, Risk Management, Internal Audit, Compliance, and business stakeholders to ensure that information security risks are effectively managed and regulatory requirements are met.

Key Responsibilities & Main Duties:

Information Security Governance

• Support the development, implementation, and maintenance of Group Information Security policies, standards, procedures, and control frameworks.
• Ensure governance requirements are communicated and implemented consistently across all Group entities and countries.
• Manage the lifecycle of Information Security policies, standards, and procedures, including development, periodic review, stakeholder consultation, approval coordination, publication, and compliance monitoring.
• Monitor compliance with approved security policies and standards.
• Support governance committees and prepare management reports, presentations, and governance updates.
• Maintain documentation associated with governance frameworks and control requirements.
• Manage the Information Security Risk Management process across the Group.
• Conduct and coordinate security risk assessments for projects, systems, applications, and third-party services.
• Maintain the Group Information Security Risk Register and ensure risks are appropriately documented and tracked.
• Monitor the status of risk treatment plans and remediation activities.
• Support risk reporting to management, risk committees, and governance forums.
• Assess emerging cyber threats and evaluate potential impacts on the Bank's risk posture.
• Facilitate periodic reviews of risk acceptance and risk exceptions.

Internal Control System (ICS) Management & Coordination

• Manage the day-to-day administration of Information Security processes and controls within the Bank's Internal Control System (ICS).
• Maintain an accurate inventory of Information Security processes, control objectives, risks, control activities, and assigned control owners.
• Coordinate periodic reviews of Information Security processes and controls to ensure documentation remains current, complete, and effective.
• Work with process owners, control owners, and business stakeholders to update process documentation, control descriptions, risk assessments, and supporting evidence as part of the control lifecycle.
• Track review cycles and ensure all IC S processes and controls are reviewed, revalidated, and approved in accordance with established governance requirements.
• Perform quality assurance reviews to verify that control documentation, testing evidence, and process updates meet internal standards.
• Monitor control performance, control test results, and remediation activities, ensuring issues are tracked through to closure.
• Identify control gaps, process weaknesses, and opportunities for improvement and recommend corrective actions.
• Produce regular management reports and dashboards detailing review status, overdue actions, control effectiveness, and remediation progress.
• Support internal audits, external audits, regulatory examinations, and assurance reviews relating to Information Security controls maintained within the IC S.
• Facilitate control owner attestations and evidence collection activities required under theICS framework.
• Escalate overdue reviews, ineffective controls, and unresolved remediation actions to the Head of Information Security GRC.

Regulatory Compliance & Security Compliance Monitoring

• Support compliance with regulatory, legal, and industry requirements applicable across the Bank's operating jurisdictions.
• Coordinate information security compliance assessments and reviews.
• Monitor compliance against internal policies, regulatory obligations, and industry standards.
• Assist in responding to regulatory examinations, audits, and supervisory reviews.
• Track regulatory changes and support implementation of new requirements within the security control environment.
• Maintain compliance obligations and regulatory requirements registers.

Security Assurance & Control Validation

• Coordinate security control assessments, compliance reviews, and control effectiveness evaluations.
• Support internal and external audits relating to information security.
• Track audit findings, regulatory observations, and risk issues through to closure.
• Validate evidence submitted for remediation activities and control improvements.
• Monitor control maturity and identify opportunities for enhancing security posture.
• Support periodic security maturity assessments using industry-recognized frameworks.

Governance, Risk & Compliance Reporting

• Develop and maintain security dashboards, Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and management reports.
• Prepare monthly, quarterly, and annual reporting for Group Information Security management.
• Provide meaningful analysis of security risks, compliance status, and remediation progress.
• Ensure timely escalation of overdue actions, significant risks, and compliance concerns.
• Support Board, Management Committee, and Risk Committee reporting requirements.

Third-Party & Supplier Security Risk Management

• Coordinate security due diligence assessments for vendors, outsourcing providers, fintech partners, and other third parties.
• Perform security reviews during onboarding and periodic reassessments.
• Monitor third-party remediation activities and risk treatment actions.
• Support contract security requirement reviews and supplier risk governance activities.
• Maintain third-party security risk tracking and reporting mechanisms.

Security Awareness & Cybersecurity Culture

• Support the Group Information Security Awareness Program across all countries and subsidiaries.
• Coordinate mandatory security awareness training and periodic awareness campaigns.
• Conduct phishing simulations and track user awareness metrics.
• Assist business units in meeting regulatory awareness and training requirements.
• Promote cybersecurity awareness through targeted communication and engagement initiatives.

Stakeholder Management & Coordination

• Act as a primary coordination point between Information Security, Technology, Risk, Compliance, Internal Audit, and business units.
• Support Group-wide GRC initiatives and security transformation programs.
• Facilitate risk and compliance discussions across country operations and business entities.
• Build strong relationships with key stakeholders to promote effective security governance practices.
• Support regulatory engagements and external assessments when required.

Education

• Bachelor's degree in information security, Computer Science, Information Technology, Risk Management, Business Administration, or a related field.

Professional Certifications

One or more of the following certifications is highly desirable:

• CISM (Certified Information Security Manager)
• CISSP (Certified Information Systems Security Professional)
• CRISC (Certified in Risk and Information Systems Control)
• CISA (Certified Information Systems Auditor)
• ISO 27001 Lead Auditor or Lead Implementer
• COBIT Foundation or COBIT Design & Implementation
• Relevant banking, risk, governance, or compliance certifications

Experience

• 8-10 years of experience in Information Security, Cyber Risk, IT Risk, Information Security Governance, Compliance, or Security Assurance.
• Minimum 3-5 years of experience in a GRC leadership, management, or senior specialist role.
• Experience within banking, financial services, fintech, or other highly regulated industries.
• Demonstrated experience conducting risk assessments, compliance reviews, and security governance activities.
• Experience working with regulatory frameworks and information security standards.
• Experience coordinating audits, regulatory reviews, and remediation programs.
• Experience working in multinational and matrix environments is highly desirable.
• Exposure to Group-level governance and reporting structures is preferred.
• Enterprise Information Security Governance
• Regulatory Compliance Management
• Security Assurance & Control Testing
• Banking and Financial Services Regulations
• Policy Framework Development
• Information Security Standards and Frameworks
• Executive and Board-Level Reporting
• Strategic Leadership and Decision Making
• Stakeholder Management and Influence
• Program and Transformation Management
• Risk Analytics and Reporting
• Strong written and verbal communication skills
• Ability to drive change and influence across a complex multinational organization

Language Requirements

• Fluent English (written and spoken).
• Additional languages relevant to the Bank's operating countries would be advantageous.
• Information Security Governance
• Regulatory Compliance Management
• Information Security Assurance
• IT General Controls (ITGC)
• Security Frameworks (ISO 27001, NIST CSF, COBIT)
• Third-Party Risk Management
• Audit & Compliance Coordination
• Security Metrics & Reporting

Banking & Regulatory Knowledge

• Banking regulatory requirements
• Technology risk management
• Data protection and privacy regulations
• Outsourcing and third-party risk requirements
• Cybersecurity governance and regulatory expectations within financial services