Information Security Compliance Officer

About the role

A leading digital bank is hiring an Information Security Compliance Officer through Envision Employment Solutions. Based in the Security GRC team, you run the programmes that prove the bank's controls work, covering PCI DSS, SOC 2, ISO 27001 and the Central Bank of Egypt's cybersecurity regulations, including the Egypt Financial Cybersecurity Framework. The workplace is on site.

Key responsibilities

• Manage end-to-end compliance programmes for PCI DSS (v4.0.x), SOC 2 Type I/II, ISO/IEC 27001:2022 and other standards, from scoping through certification and ongoing maintenance
• Ensure ongoing compliance with the CBE Egypt Financial Cybersecurity Framework and related CBE regulations, circulars and instructions
• Conduct gap assessments and readiness reviews, build and track remediation plans with control owners until closure
• Coordinate CBE cybersecurity maturity self-assessments and independent assessments, prepare evidence and track regulatory findings and action plans
• Lead PCI DSS activities, including CDE scoping, segmentation validation, SAQs, ROCs, AOCs and quarterly ASV scan tracking
• Manage SOC 2 audits against the Trust Services Criteria, including control design, evidence collection and auditor coordination
• Act as main contact for external auditors, QSAs, certification bodies and regulators during audits and inspections
• Maintain a unified control framework mapping requirements across PCI DSS, SOC 2, ISO 27001, NIST CSF, SWIFT CSCF and CBE regulations
• Monitor controls, run periodic reviews and spot checks, and report on control effectiveness
• Develop, review and maintain security policies, standards and procedures; track and implement changes in regulations such as the Personal Data Protection Law No. 151 of 2020
• Support third-party and vendor security risk assessments, and prepare compliance dashboards and reports for management, risk committees and the board
• Run security compliance awareness sessions for staff and control owners

Required profile

• Bachelor's degree in Computer Science, Information Security, IT, Business or a related field, or equivalent practical experience
• 2 to 4 years of information security experience, including at least 2 years hands-on managing compliance programmes
• Expert knowledge of CBE cybersecurity regulations and frameworks, including the Egypt Financial Cybersecurity Framework and its maturity assessment approach, plus experience with CBE inspections and findings
• Hands-on PCI DSS experience (scoping, SAQ/ROC preparation, working with QSAs) and SOC 2 readiness and audit experience
• Preferred certifications: PCI Professional (PCIP) or PCI QSA training, ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, CRISC or CISM, CompTIA Security+

Required skills

• Knowledge of ISO/IEC 27001:2022, ISO/IEC 27002, NIST CSF, NIST SP 800-53, SWIFT CSCF and COBIT
• Understanding of security controls across IT infrastructure, applications, cloud and identity management
• Experience with GRC platforms such as ServiceNow GRC, RSA Archer or MetricStream
• Structured, organised working style, clear communication with technical and business teams, and ability to influence control owners without direct authority