Assistant Vice President – Information Security

The Assistant Vice President (AVP) – Information Security in IS GRC is a cross‑functional role responsible for designing, embedding, and operating foundational IS GRC capabilities across the company under the strategic direction of the Head of IS GRC. The role acts as a central orchestrator and Centre of Excellence (CoE) enabler, creating scalable frameworks, common approaches, and enabling platforms that ensure consistent risk decisioning, regulatory confidence, and measurable improvement in the Bank’s security posture. In a threat landscape shaped by accelerating digitization, cloud adoption, expanded third‑party dependency, and heightened regulatory scrutiny, the AVP ensures that IS GRC stays predictable, defensible, and intelligence‑driven—moving the organization from compliance activity to risk‑based outcomes.

Responsibilities

• Lead InfoSec Risk Management orchestration and sustained risk culture change, ensuring risk is managed consistently across ISG and aligned stakeholder groups.
• Define and implement the Information Security Risk Management Strategy & Framework, including the end‑to‑end InfoSec Risk Management Lifecycle (identify → assess → treat → monitor → report).
• Design, maintain, and govern foundational risk assets: InfoSec Risk Register, risk heatmap, risk/control library, and decisioning artefacts that enable consistent senior risk decisions.
• Provide risk decisioning direction through clear risk narratives, aggregation logic, concentration risk insights, and remediation prioritization aligned to risk appetite.
• Develop and maintain the bank’s multi-year Information Security GRC strategy, updating annually to reflect business priorities, objectives and emerging threats.
• Oversee delivery of strategic cyber security initiatives, ensuring alignment with approved budgets and business objectives.
• Define and embed KPIs and KRIs that measure the effectiveness of the Information Security program.
• Regularly assess and benchmark the bank’s security posture against industry standards and peers.
• Manage Information Security services under IS GRC and review other ISG services to ensure risk mitigation and regulatory compliance.

Requirements

• Overall 12+ years of experience, with at least 2–3 years of dedicated responsibility in one or more GRC domains (Policy, Governance & Culture, Cyber Strategy & Program Management, Risk & Compliance).
• Proven track record of managing enterprise-level projects and maintaining direct and indirect relationships with senior and executive management.
• Strong knowledge across Information Security and Cyber Security disciplines.
• Significant experience in the banking or financial services sector, with a deep understanding of regulatory requirements and security frameworks such as ISO 27001, NIST 800 series, PCI-DSS, SWIFT CSP, and COBIT.
• Solid understanding of evolving technology stacks, associated risks, and control environments.
• Demonstrated ability to conduct comprehensive risk assessments and translate findings into actionable mitigation strategies.
• Strong analytical capability combined with sound judgement for prioritization and decision-making under complex scenarios.
• Excellent communication and stakeholder management skills to influence and collaborate across diverse teams.
• Master’s degree in information technology, Information Security, or related discipline.
• Professional certifications such as CISA, CISM, CISSP, CRISC or equivalent are highly desirable.