Information Security Risk Manager

About the role

The Information Security Risk Manager will lead and mature the organization’s information security risk management framework. Reporting to senior leadership, you will identify, assess and mitigate cybersecurity risks across technology assets, ensuring compliance with internal policies, banking regulations and international standards.

Key responsibilities

• Own the Information Security Risk Management Framework (ISRMF) aligned with NIST CSF, ISO/IEC 27001/27005 and local banking cybersecurity guidelines.
• Conduct risk assessments and threat‑modeling for new and existing systems, documenting vulnerabilities and recommending controls.
• Review solution architectures to verify security, resilience and regulatory compliance before implementation.
• Maintain the IT Risk Tracker and security heat‑map, and perform thematic technology reviews as part of the risk assurance plan.
• Plan and oversee compliance audits, risk assessments and information security governance activities.
• Monitor regulatory and technology changes that could affect the organization’s risk profile.
• Escalate critical risk items to management and ensure timely remediation with stakeholders.
• Participate in product, service and system launches to identify emerging risks and embed appropriate controls.

Required profile

• Bachelor’s degree in Information Security, Computer Science, IT, Risk Management or a related field; a Master’s degree (MBA, MIS, Cybersecurity) is a plus.
• 10+ years of information security risk management experience within banks or financial institutions.
• Upper‑intermediate to advanced proficiency in English (reading, writing, speaking).
• Strong analytical ability to translate technical risk into business language.

Required skills

• NIST Cybersecurity Framework
• ISO/IEC 27001 and ISO/IEC 27005
• PCI DSS and PCI PIN Security standards
• Threat modeling and risk assessment methodologies
• Operational risk tools such as RCSA, KRI and loss data management
• Information security governance and audit processes