grc manager

Stellar Hunters

<div><h4 class="jobSectionHeader">Job Summary</h4>
We are seeking a Cyber GRC Manager to lead and mature the company&rsquo;s cyber governance, risk, and compliance (GRC) program. The successful candidate will partner with Security, IT, Legal, Risk, and business stakeholders to design, implement, and operate controls, policies, and risk management practices that reduce cyber risk and support business objectives. This role will own compliance initiatives, third-party risk assessments, policy lifecycle management, and metrics to drive continuous improvement across the organization.<h4 class="jobSectionHeader">
Key Responsibilities</h4><h5 class="jobSectionHeader">
GRC Strategy &amp; Program Leadership</h5><ul><li>
Develop and evolve a risk-based cyber GRC strategy that aligns with enterprise risk appetite and business priorities.</li><li>
Lead the GRC program, including governance forums, risk assessment cadence, control frameworks, and remediation tracking.</li><li>
Partner with senior leadership to translate regulatory and business requirements into practical program objectives and roadmaps.</li></ul><h5 class="jobSectionHeader">
Policy, Standards &amp; Control Management</h5><ul><li>
Maintain and enhance information security policies, standards, and procedures; ensure clear ownership and version control across the policy lifecycle.</li><li>
Define and maintain control objectives mapped to frameworks (e.g., NIST CSF, ISO 27001, SOC 2) and ensure consistent implementation across teams.</li><li>
Coordinate control testing, assessments, and remediation activities with internal teams and external assessors.</li></ul><h5 class="jobSectionHeader">
Risk Assessment &amp; Third-Party Risk Management</h5><ul><li>
Conduct enterprise and technology risk assessments; identify, evaluate, and prioritize cyber risks and mitigation plans.</li><li>
Own third-party risk management processes including vendor risk assessments, due diligence, contract security requirements, and ongoing monitoring.</li><li>
Work with procurement and vendor owners to remediate deficiencies and reduce supply chain risk.</li></ul><h5 class="jobSectionHeader">
Compliance &amp; Audit Support</h5><ul><li>
Manage compliance programs and readiness for relevant regulations and standards (e.g., SOC 2, ISO 27001, GDPR, HIPAA where applicable).</li><li>
Act as primary liaison for internal and external audits, prepare evidence and reporting, and coordinate remediation activities.</li><li>
Maintain documentation and continuous evidence of controls to support attestations and regulatory reporting.</li></ul><h5 class="jobSectionHeader">
Metrics, Reporting &amp; Continuous Improvement</h5><ul><li>
Define and report GRC metrics and dashboards (e.g., risk posture, control maturity, remediation timelines, vendor risk status) to leadership and stakeholders.</li><li>
Use data and trend analysis to identify program gaps, recommend improvements, and measure the effectiveness of risk reduction efforts.</li><li>
Develop and maintain GRC playbooks, runbooks, and process documentation to enable repeatable, auditable practices.</li></ul><h4 class="jobSectionHeader">
Required Qualifications - Skills &amp; Experience</h4><ul><li>
Bachelor&rsquo;s degree in Information Security, Cybersecurity, IT, Risk Management, or a related field, or equivalent practical experience.</li><li>
5+ years of hands-on experience in cyber governance, risk, and compliance, information security, or related roles.</li><li>
Practical knowledge of common security frameworks and standards (e.g., NIST CSF, ISO 27001, SOC 2) and experience mapping controls to frameworks.</li><li>
Experience managing third-party/vendor risk assessments, contract security requirements, and remediation workflows.</li><li>
Strong communication and stakeholder management skills with the ability to influence technical and non-technical audiences.</li><li>
Analytical mindset with experience developing risk assessments, metrics, and executive-level reporting.</li><li>
Familiarity with GRC platforms, risk assessment tools, ticketing systems, and common productivity software.</li></ul><h4 class="jobSectionHeader">
Preferred Qualifications</h4><ul><li>
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CDPSE preferred.</li><li>
Experience supporting SOC 2, ISO 27001, or other third-party audits and working with external assessors.</li><li>
Background in cloud security, identity and access management, or secure software development lifecycle practices.</li><li>
Experience implementing or operating GRC tooling (e.g., Archer, RiskLens, OneTrust, ServiceNow GRC) is a plus.</li></ul><h4 class="jobSectionHeader">
Work Environment &amp; Compensation</h4><ul><li>
Full-time position with a hybrid onsite/remote model; occasional travel and after-hours engagement may be required to support assessments and incident response activities.</li><li>
Competitive salary commensurate with experience and a comprehensive benefits package, including health insurance, retirement plan options, and paid time off.</li><li>
Opportunities for professional development, cross-functional collaboration, and career growth within Security, IT, and Risk functions.</li><li>
Inclusive, respectful culture that values diversity, equity, and work-life balance.</li></ul></div>

Cyber GRC Manager

Omada Rail Systems

<div><ul><li>Permanent Contract
</li></ul><ul><li>Mid-Senior Level
</li></ul><ul><li>Doha
</li></ul><ul><li>Consultancy</li></ul></div>
 <div>About Us 
Egis is a leading global architectural, consulting, construction engineering, operations and mobility services firm. We create and operate intelligent infrastructure and buildings that both respond to the climate emergency and contribute to balanced, sustainable and resilient development. Our 20,500 employees operate across over 100 countries, deploying their expertise to develop and deliver cutting-edge innovations and solutions for clients. Through the wide range of our activities, we are central to the collective organisation of society and the living environment of citizens all over the world.&quot;
With 3,500 employees across 8 countries in the Middle East, Egis has delivered over 700 complex development projects, stimulating economic growth and enhancing quality of life. Ranked among the top ten firms in the Middle East by Engineering News Record (ENR), Egis is committed to sustainable development. The Group&rsquo;s operations in the Middle East are built on strategic acquisitions and a deep understanding of local market conditions. Egis&rsquo; long history of providing comprehensive engineering, consulting, and project management services makes it a trusted partner for regional governments, investors, and developers. 
About the Role 
We are seeking a highly skilled Cybersecurity Governance (GRC) Manager to join our Roads Operations and Maintenance (O&amp;M) team in Doha, Qatar. In this critical role, you will be responsible for developing, implementing, and maintaining our cybersecurity governance framework, ensuring the protection of our road infrastructure and related systems.<ul><li>
Develop and oversee the implementation of cybersecurity policies, procedures, and standards aligned with industry best practices and regulatory requirements</li><li>
Conduct regular risk assessments and audits to identify vulnerabilities in our road operations and maintenance systems</li><li>
Collaborate with cross-functional teams to integrate cybersecurity measures into our operational technology (OT) environments</li><li>
Manage the organization's compliance with relevant cybersecurity regulations and standards in the transportation sector</li><li>
Lead the development and execution of cybersecurity awareness programs for staff involved in roads O&amp;M</li><li>
Establish and maintain a robust incident response plan for potential cybersecurity threats to road infrastructure</li><li>
Provide regular reports and updates to senior management on the organization's cybersecurity posture and risk landscape</li><li>
Stay informed about emerging cybersecurity threats and trends in critical infrastructure protection</li></ul> 
What do we need from you 
<ul><li>
Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred</li><li>
Minimum of 5 years of experience in cybersecurity governance, risk management, and compliance</li><li>
Strong knowledge of GRC frameworks such as NIST, ISO 27001, and COBIT</li><li>
Demonstrated experience with cybersecurity in operational technology (OT) environments</li><li>
Proficiency in risk assessment and management methodologies</li><li>
Excellent communication, leadership, and project management skills</li><li>
In-depth knowledge of relevant regulations and standards in the transportation sector</li><li>
CISSP, CISM, or other relevant cybersecurity certifications strongly preferred</li><li>
Experience in the transportation or infrastructure sector is a plus</li><li>
Familiarity with ICS/SCADA systems security</li><li>
Expertise in cybersecurity for critical infrastructure and roads operations and maintenance</li><li>
Strong understanding of Governance, Risk, and Compliance (GRC) frameworks and their application in a complex operational environment</li><li>
Ability to work effectively in a multicultural environment and adapt to the local context in Doha, Qatar</li></ul> 
What's in it for you?</div>

Cybersecurity Governance (GRC) Manager (Roads O&M)

Confidential Government

<div>
 
 
 Senior Manager &ndash; Governance, Risk and Compliance (GRC)
 
 
 
 
 Standard Title:
 
 Risk &amp; Compliance Manager
 
 
 
 Company:
 
 Confidential Government Entity
 
 
 
 Location:
 
 Riyadh, Saudi Arabia
 
 
 
 Workplace Type:
 
 On-site
 
 
 
 Employment Type:
 
 Full-time
 
 
 
 Seniority Level:
 
 Mid&ndash;Senior Level
 
 
 
 
 
 
 Job Purpose
 
 
 
 The Senior Manager &ndash; Governance, Risk and Compliance (GRC) is responsible for leading the design, implementation, and continuous enhancement of governance structures, enterprise risk management, and compliance systems. The role ensures that institutional practices align with applicable laws, regulatory requirements, and approved governance frameworks, while supporting organizational effectiveness, risk resilience, ethical conduct, and sound decision-making.
 
 
 
 
 
 
 Key Accountabilities &amp; Responsibilities
 
 
 
 
 1. Governance Framework &amp; Institutional Oversight
 
 
 <ul>
 <li>
 Develop, review, and maintain governance frameworks, charters, policies, and procedures to ensure clarity of authority, roles, and accountability.
 </li>
 <li>
 Ensure consistent application of governance principles across all organizational levels.
 </li>
 <li>
 Provide advisory support to executive management and governance committees on governance-related matters.
 </li>
 <li>
 Oversee documentation and enforcement of delegation of authority matrices and decision-rights frameworks.
 </li>
 <li>
 Promote ethical standards, conflict-of-interest management, and institutional integrity.
 </li>
 </ul>
 
 
 2. Enterprise Risk Management (ERM)
 
 
 <ul>
 <li>
 Establish and lead an integrated Enterprise Risk Management framework covering strategic, operational, financial, regulatory, and reputational risks.
 </li>
 <li>
 Direct risk identification, assessment, prioritization, and aggregation processes.
 </li>
 <li>
 Maintain and update the enterprise risk register and ensure alignment with organizational objectives.
 </li>
 <li>
 Define risk appetite and tolerance levels in coordination with senior leadership.
 </li>
 <li>
 Monitor emerging risks and ensure proactive mitigation strategies are in place.
 </li>
 <li>
 Prepare comprehensive risk reporting for senior management and oversight committees.
 </li>
 </ul>
 
 
 3. Compliance &amp; Regulatory Management
 
 
 <ul>
 <li>
 Develop and implement organization-wide compliance programs, policies, and controls.
 </li>
 <li>
 Ensure full compliance with all applicable laws, regulations, directives, and supervisory requirements.
 </li>
 <li>
 Monitor regulatory developments and assess their impact on organizational policies and operations.
 </li>
 <li>
 Coordinate with regulators, oversight bodies, and external stakeholders as required.
 </li>
 <li>
 Oversee management of compliance breaches, investigations, corrective actions, and preventive measures.
 </li>
 <li>
 Promote compliance awareness, training, and a culture of accountability.
 </li>
 </ul>
 
 
 4. Internal Controls, Audit &amp; Assurance
 
 
 <ul>
 <li>
 Design and strengthen internal control frameworks to safeguard assets, ensure data integrity, and enhance operational effectiveness.
 </li>
 <li>
 Coordinate with internal and external audit functions during planning, execution, and follow-up.
 </li>
 <li>
 Review audit findings and ensure timely implementation of remediation plans.
 </li>
 <li>
 Monitor control effectiveness and drive continuous improvement initiatives.
 </li>
 <li>
 Support quality assurance efforts to enhance compliance, efficiency, and governance maturity.
 </li>
 </ul>
 
 
 5. Leadership, Capability Building &amp; Stakeholder Management
 
 
 <ul>
 <li>
 Lead, coach, and develop direct reports and GRC professionals.
 </li>
 <li>
 Build internal capabilities in governance, risk management, and compliance across departments.
 </li>
 <li>
 Act as a trusted advisor to senior leadership and key stakeholders.
 </li>
 <li>
 Facilitate cross-functional collaboration to embed GRC practices into core business processes.
 </li>
 <li>
 Contribute to organizational resilience, sustainability, and long-term value creation.
 </li>
 </ul>
 
 
 Qualifications &amp; Experience
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in Business Administration, Finance, Accounting, Law, Risk Management, or a related discipline (Master&rsquo;s degree preferred).
 </li>
 <li>
 8&ndash;12 years of progressively responsible experience in governance, risk, compliance, audit, or related functions.
 </li>
 <li>
 Prior experience within government entities or regulated environments is strongly preferred.
 </li>
 <li>
 Strong understanding of governance principles, risk management methodologies, and compliance frameworks.
 </li>
 <li>
 Professional certifications are an advantage (e.g., CRMA, CIA, CISA, CERM, CGR, ISO 31000).
 </li>
 </ul>
 
 
 Core Competencies &amp; Skills
 
 
 <ul>
 <li>
 Strategic thinking and sound professional judgment.
 </li>
 <li>
 Advanced analytical, risk assessment, and problem-solving skills.
 </li>
 <li>
 Strong leadership, communication, and influencing abilities.
 </li>
 <li>
 High ethical standards, independence, and confidentiality.
 </li>
 <li>
 Excellent report writing and presentation skills.
 </li>
 <li>
 Fluency in Arabic and English.
 </li>
 </ul>
 
 
 Alignment &amp; Compliance (Headlines Only)
 
 
 <ul>
 <li>
 
 Saudi Vision 2030
 
 </li>
 <li>
 
 National Governance Frameworks
 
 </li>
 <li>
 
 Regulatory &amp; Supervisory Authority Requirements
 
 </li>
 <li>
 
 Public Sector Accountability &amp; Transparency Standards
 
 </li>
 </ul>
 
 
 Recommended Industries
 
 
 <ul>
 <li>
 Government Administration
 </li>
 <li>
 Investment Management
 </li>
 <li>
 Real Estate
 </li>
 <li>
 Retail
 </li>
 </ul>
 
 
 Job Functions
 
 
 <ul>
 <li>
 Risk &amp; Compliance
 </li>
 <li>
 Accounting / Auditing
 </li>
 <li>
 Quality Assurance
 </li>
 </ul>
 
 
</div>

Senior Manager - Governance, Risk and Compliance

Confidential

<div>
 
 We are looking for an experienced Governance, Risk &amp; Compliance (GRC) professional to lead the development, implementation, and oversight of GRC frameworks, policies, and procedures, ensuring alignment with organizational objectives and regulatory requirements.
 
 
 
 
 
 This role oversees day-to-day operations across risk management, compliance, sustainability (ESG), and policy development, while fostering a culture of transparency, accountability, and ethical conduct. The position is well suited for candidates with experience in large organizations or group structures, particularly within retail, telecom, or multi-business environments, and those with prior consulting or advisory experience.
 
 
 
 
 
 Key Responsibilities:
 
 
 - Lead the development, enhancement, and implementation of GRC frameworks, policies, and procedures.
 
 
 -Oversee governance, risk, and compliance operations and ensure effective execution.
 
 
 - Identify, assess, and mitigate operational, financial, and strategic risks.
 
 
 - Ensure all policies, procedures, and compliance documentation are up to date and aligned with regulatory requirements.
 
 
 -Design and deliver GRC training and awareness programs.
 
 
 -Monitor compliance activities and proactively identify risks and gaps.
 
 
 -Oversee the preparation and governance of Sustainability / ESG reporting.
 
 
 -Review penalties, violations, and regulatory matters, and ensure corrective actions are implemented.
 
 
 -Track regulatory and industry developments and assess their impact on the organization.
 
 
 -Promote a strong culture of ethics, transparency, and accountability.
 
 
 
 
 
 Managerial Responsibilities (based on level):
 
 
 - Cascade GRC strategy into operational plans and ensure cross-functional alignment.
 
 
 -Lead, coach, and develop the GRC team, setting objectives and managing performance.
 
 
 -Strengthen governance frameworks to reduce risk exposure and enhance stakeholder confidence.
 
 
 -Oversee departmental policies, controls, and compliance standards.
 
 
 -Prepare and review periodic Risk Management and Compliance reports.
 
 
 
 
 
 Requirements:
 
 
 -Bachelor&rsquo;s degree in Business Administration, Finance, Law, or a related field.
 
 
 -Minimum 6+ years of experience in Governance, Risk, Compliance, or related fields.
 
 
 -Strong experience in policies and procedures development.
 
 
 -Exposure to Sustainability / ESG initiatives.
 
 
 -Experience within large organizations, retail groups, telecom, or multi-business environments.
 
 
 -Consulting or advisory background is a strong advantage.
 
 
 
 
 
 Certifications (Preferred):
 
 
 CIA, GRCP, CISA, CRA, or similar professional certifications.
 
</div>

GRC Expert

malomatia

<div>
 
 Job Description
 
 
 
 
 Key Outcomes (What success looks like)
 
 
 
 <ul>
 <li>
 Corporate GRC requests are triaged, tracked, delivered, and reported with clear SLAs and priorities.
 </li>
 <li>
 Policies/standards/procedures are usable, enforced, and updated&mdash;not shelfware.
 </li>
 <li>
 Risk and compliance reporting is accurate, timely, and defensible for leadership and auditors.
 </li>
 <li>
 Client deliverables are clean, structured, and aligned to agreed frameworks (e.g., QCSF/NIA, ISO 27001, NIST).
 </li>
 <li>
 Stakeholders respect the function because you add clarity and control, not bureaucracy.
 
 
 </li>
 </ul>
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Corporate GRC Operations (High-Volume Request Handling)
 </li>
 <li>
 Act as the single point of accountability for BU GRC operations: intake, triage, prioritization, execution, and closure.
 </li>
 <li>
 Build and run a GRC request pipeline (ticketing/backlog/kanban), including SLAs, dependencies, and status reporting.
 </li>
 <li>
 Challenge vague requests: convert noise into clear scope, deliverables, owners, and deadlines.
 </li>
 <li>
 Enforce governance through decisions and escalation.
 </li>
 <li>
 Governance (Policies, Standards, Internal Controls)
 </li>
 <li>
 Develop and maintain BU security governance artifacts: policies, standards, procedures, baselines, templates.
 </li>
 <li>
 Ensure governance aligns with corporate requirements and applicable regulations, with traceability to controls/frameworks.
 </li>
 <li>
 Drive policy adoption via implementation guidance, control owners, and periodic attestations.
 </li>
 <li>
 Produce executive-friendly outputs: dashboards, governance reports, action trackers.
 </li>
 <li>
 Risk Management (Practical, Not Theoretical)
 </li>
 <li>
 Own the BU risk register: identification, assessment, scoring, treatment plans, and acceptance workflows.
 </li>
 <li>
 Run risk workshops with IT/Operations/Projects to capture real risks and convert them into actions.
 </li>
 <li>
 Manage risk exceptions/waivers (justification, compensating controls, approval, expiry, re-validation).
 </li>
 <li>
 Track remediation progress, validate evidence, and report risk movement over time.
 </li>
 <li>
 Compliance &amp; Audit Execution (Evidence-Driven)
 </li>
 <li>
 Lead BU readiness for internal/external audits: evidence collection, control testing coordination, gap closure plans.
 </li>
 <li>
 Maintain compliance mapping for relevant frameworks (e.g., ISO 27001/27002, NIST CSF/800-53, CIS Controls, local frameworks such as QCSF/NIA when applicable).
 </li>
 <li>
 Coordinate with Legal/HR/IT/Procurement on compliance topics (privacy, records, access controls, vendor risk).
 </li>
 <li>
 Produce audit artifacts: SoA, control matrices, evidence packs, CAPA plans.
 </li>
 <li>
 Third-Party &amp; Supplier Risk
 </li>
 <li>
 Execute/coordinate third-party security assessments: questionnaires, evidence review, risk ratings, remediation follow-up.
 </li>
 <li>
 Support contract/security clauses review with Procurement/Legal.
 </li>
 <li>
 Maintain supplier risk records and ensure closure of high/critical findings.
 </li>
 <li>
 Client-Facing GRC Delivery (Part-Time Allocation)
 </li>
 <li>
 Contribute to client assessments and advisory engagements: maturity assessments, gap analysis, compliance roadmaps, risk registers, policies, and reporting.
 </li>
 <li>
 Support delivery managers/project leads with structured, reusable deliverables and strong documentation quality.
 </li>
 <li>
 Participate in client meetings/workshops and translate discussions into actionable outputs.
 </li>
 <li>
 Metrics, Reporting, and Leadership Communication
 </li>
 <li>
 Run recurring reporting: GRC KPIs/KRIs, compliance status, audit readiness, top risks, overdue actions.
 </li>
 <li>
 Brief BU leadership with clear recommendations, decisions needed, and escalation items.
 </li>
 <li>
 Maintain transparency: stakeholders should always know what&rsquo;s in progress, blocked, overdue, and why.
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 
 Required Experience &amp; Qualifications
 
 
 
 <ul>
 <li>
 8 years in cybersecurity GRC, risk management, compliance, or audit-heavy security roles.
 </li>
 <li>
 Proven experience running governance documentation end-to-end (policy &rarr; adoption &rarr; evidence).
 </li>
 <li>
 Solid understanding of security frameworks and control-based approaches: ISO 27001/27002, NIST CSF/800-53, CIS Controls (and QCSF/NIA if in Qatar context).
 </li>
 <li>
 Experience with audits (internal/external), evidence management, and remediation tracking.
 </li>
 <li>
 Strong stakeholder management across technical and non-technical teams.
 
 
 </li>
 </ul>
 
 Tools &amp; Delivery Skills
 
 
 
 <ul>
 <li>
 Advanced documentation and structuring: MS Word/PowerPoint, clean formatting, executive summaries.
 </li>
 <li>
 Strong Excel skills for trackers and reporting (risk registers, matrices, dashboards).
 </li>
 <li>
 Familiarity with GRC tooling
 </li>
 <li>
 Ability to manage workflows in Jira/ServiceNow/Planner/Trello or similar.
 
 
 </li>
 </ul>
 
 About Malomatia
 
 
 
 
 ABOUT US
 
 
 
 malomatia is a leading Qatar-based IT services and solutions provider, bringing together top Qatari and international talent to deliver innovative, end-to-end technology solutions that empower clients to achieve their strategic goals.
 
 
 
 Our mission
 
 
 
 Empowering Qatar&rsquo;s businesses and governments to leap into the digital future with agile, knowledge-driven solutions.
 
 
 
 Our vision
 
 
 
 To become Qatar&rsquo;s trusted knowledge partner in digital transformation, disrupting industries, shaping the future, and building a world-class tech ecosystem.
 
 
 
 Driving change that makes a real impact
 
 
 
 Since 2008, malomatia has been driving Qatar&rsquo;s digital transformation through innovative, ISO-certified IT solutions. With expertise across key public and private sectors, we empower the nation&rsquo;s vision with advanced services in cloud, cybersecurity, AI, and contact center excellence, elevating the role of technology in shaping Qatar&rsquo;s sustainable future.
 
 
 
 About The Team
 
 
 
 Established in 2008, malomatia is a Qatari leader in IT services and digital transformation. We serve key sectors including Government, Healthcare, Education, Customs, and Transportation, delivering impactful solutions that support national development goals. Powered by a diverse team of skilled Qatari and international IT professionals, we deliver innovative, high-value digital solutions tailored to the unique needs of our clients.
 
 
 Our mission is to inspire customers to thrive through digital excellence, and we envision becoming the trusted partner of choice in building a smarter society through technology and talent. We are driven by core values that define our culture and approach: ownership, integrity, empathy, teamwork, transparency, agility, excellence, trust, and innovation.
 
 
 Join us in shaping the future of technology in Qatar
</div>

Consultant - GRC

Bank Alfalah Limited

<div>
 
 Job Purpose:
 
 
 The Governance, Risk &amp; Compliance Manager is responsible for establishing, managing, and continuously improving the organization&rsquo;s information security governance, risk management, and compliance framework. The role ensures alignment with regulatory requirements, industry standards, and business objectives, while providing strategic oversight, leadership, and assurance to senior management
 
 
 
 
 
 Responsibilities:
 
 <ul>
 <li>
 Support the execution of internal and external information security audits in collaboration with the Team lead.
 </li>
 <li>
 Interpret and implement regulatory requirements and liaise with internal teams to ensure compliance.
 </li>
 <li>
 Facilitate coordination between business and technical teams to conduct comprehensive security reviews.
 </li>
 <li>
 Work with stakeholders to recommend and track risk mitigation measures, ensuring timely closure of identified gaps/observations.
 </li>
 <li>
 Maintain and oversee the information security risk register.
 </li>
 <li>
 Define and maintain risk management framework including risk assessment methodology and risk appetite alignment
 </li>
 <li>
 Coordinate with IT/security teams for mitigation strategies.
 </li>
 <li>
 Assist TL in preparation of reports/presentations for management reporting and ITSC/BITC.
 </li>
 <li>
 Lead and support the development, implementation, and continuous improvement of information security policies, procedures, and governance frameworks to ensure alignment with industry standards and regulatory requirements.
 </li>
 <li>
 Define and monitor KPIs/KRIs to measure effectiveness of security controls and risk posture
 </li>
 <li>
 Ensure organizational policies, processes, and operations achieve full compliance with SBP regulatory requirements, while maintaining alignment with cross‑border regulations.
 </li>
 <li>
 Oversee cyber security and information security (NESA Compliance) programs.
 </li>
 <li>
 Lead risk assessments and ensure compliance of vendors with security requirements
 </li>
 <li>
 Assist in finding technical gaps/weaknesses in BAFL environment through gap assessment exercise.
 </li>
 <li>
 Lead, and manage the IS GRC team in absence of Team Lead
 </li>
 <li>
 Manage risk acceptance process and ensure proper approval from the management
 </li>
 <li>
 Conduct cybersecurity awareness sessions bi-annually for employees to enhance their knowledge of security best practices, helping them recognize and prevent social engineering threats such as phishing, and promoting safer digital behavior
 </li>
 <li>
 Coordinate and manage regulatory inspections and ensure timely closure of observations
 </li>
 </ul>
 
 
</div>

Senior Manager Information Security

Truist

<div>The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.
Need Help?
If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).
Regular or Temporary:
Regular
Language Fluency: English (Required)
Work Shift:
1st shift (United States of America)<h3 class="jobSectionHeader">
Please review the following job description:</h3>
A prescriptive role that is responsible for leading a highly complex, high-risk, critical, and broad-reaching capability that must be accomplished with ownership and influence. This requires transparency, proactiveness and advocacy to identify, inventory, communicate, monitor, mitigate and evidence solutions for IAM risk. This includes a subset of the following sub-functions: a) governance b) risk and c) compliance.
ESSENTIAL DUTIES AND RESPONSIBILITIES
Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.<ul><li>
Align with IAM-wide priorities that define &lsquo;our what&rsquo; that may change based on business need</li><li>
Consistently align with Truist Vision, Mission and Values and demonstrate &lsquo;our how&rsquo; IAM works:</li><li>
o Accountability: set expectations, hold teams accountable, check-in and provide feedback</li><li>
o Remove &lsquo;IAM Blinders&rsquo;: take a Truist-wide approach to owning and resolving challenges</li><li>
o Strengthen Team: coach-up, performance manage, develop, and reward top performers/visibility</li><li>
o Management System: establish and cascade a predictable schedule for team engagement</li><li>
o Continuous Improvement: consistently seeking ways to get better</li><li>
May manage a team of 5 to 7 direct report teammates and contract workers who oversee defined structured process tasks; may have oversight for complex, unstructured processes.</li><li>
Perform hiring, coaching, terminations, disciplinary action, and performance reviews to enable and maintain the strategy.</li><li>
Oversee operational and tactical plans in support of business objectives; develop cross-departmental, and cross-CCS business cases to solve problems by making technical and financial tradeoffs.</li><li>
Apply a balance of 40% technical and 60% functional knowledge to deliver quality results.</li><li>
Design and implement the governance, risk, and compliance strategy on time and within budget:</li><li>
Formal Services Level Agreements (SLAs)</li><li>
Policy, standards, controls, key risk indicators, key performance indicators and metric reporting</li><li>
Improve the user experience and reduce the turnover of critical resources</li><li>
Incorporates a) request b) provisioning c) deprovisioning d) normal access e) privileged access f) attestations g) identity governance administration h) identify management platforms i) production support j) authentication k) authorization and l) cloud</li><li>
Enables the cross-CCS needs of Architecture, Cyber Assurance, Cyber Defense and GRC</li><li>
Accounts for the business needs for all lines of business and ET&amp;O partner organizations, which includes, but is not limited to, Consumer, Wholesale, Insurance, Corporate Functions, Enterprise Data and Operations</li><li>
Alignment with the CCS GRC, Business Unit Risk Management, Technology Risk, Truist Audit Services and Regulatory Relations, as well as the needs of the lines of business that they support</li><li>
Engagement with Corporate Communications and Human Resources to enable teammate and contract worker adoption and adherence to the core elements needed to protect the bank</li><li>
Support of other functions seeking to improve their risk posture</li><li>
Engagement model for partnering with Divisional CISOs to drive effectiveness and efficiency</li><li>
Proactively engage with stakeholders to make them aware and willing to adopt our solutions, which includes managing up, out, and down to avoid surprises and position our solutions to be successful.</li></ul> 
QUALIFICATIONS 
Required Qualifications: 
The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.<ul><li>
Bachelor&rsquo;s degree or equivalent</li><li>
15 years&rsquo; technical experience working in the GRC control function</li><li>
10 years&rsquo; experience as a manager</li><li>
10 yeas&rsquo; experience in operational planning, tactical planning, and execution</li><li>
10 years managing simple and structured work</li><li>
10 years managing complex and unstructured work</li><li>
10 years&rsquo; experience leading diverse teams, such as teammates, contract workers, onshore, offshore resources, and/or managed services</li><li>
5 years&rsquo; experience and expert-level technical knowledge of product knowledge and processes for specific IAM areas (e.g., Active directory, RACF, Idaptive, CyberArk, PRIVA, Oracle OIM, Persistent Ignite)</li><li>
10 years&rsquo; experience and basic functional knowledge of tools and processes for the broader IAM capability</li><li>
7 years&rsquo; experience and expert-level strength in soft skills and interpersonal communications</li><li>
10 years&rsquo; technical experience working for a top 10 US bank</li><li>
10 years&rsquo; experience collaborating with the following functions: a) infrastructure b) application development c) application support d) business unit risk management e) technology risk f) audit and g) external auditors</li><li>
10 years&rsquo; experience collaborating with the following peer functions in corporate cyber security</li><li>
10 years&rsquo; experience managing the remediation of regulatory matters and internal findings</li><li>
10 years&rsquo; experience in strategic planning and applying industry best practices to operations (NIST, FFIEC)</li></ul> 
Preferred Qualifications:
<ul><li>Understand multiple approaches to designing IAM technical solutions</li><li>
Experience in waterfall and agile project management methodologies</li><li>
Experience managing contracts for IAM managed service providers</li><li>
CISSP Certification</li><li>
Process re-engineering</li></ul>
***For this opportunity, Truist will not sponsor an applicant for work visa status or employment authorization, nor will we offer any immigration-related support for this position (including, but not limited to H-1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN-1 or TN-2, E-3, O-1, or future sponsorship for U.S. lawful permanent residence status.)
OTHER JOB REQUIREMENTS / WORKING CONDITIONS
Sitting 
Constantly (More than 50% of the time) 
Visual / Audio / Speaking 
Able to access and interpret client information received from the computer and able to hear and speak with individuals in person and on the phone. 
Manual Dexterity / Keyboarding 
Able to work standard office equipment, including PC keyboard and mouse, copy/fax machines, and printers. 
Availability 
Able to work all hours scheduled, including overtime as directed by manager/supervisor and required by business need. 
Travel 
Minimal and up to 10%
General Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist&rsquo;s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist&rsquo;s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.
Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.
EEO is the Law E-Verify IER Right to Work</div>

Cybersecurity Process Control and Effectiveness Director - Cyber Maturity Assessment Lead

Search 10000+ Grc manager jobs near you this May. New roles added regularly across leading industries. Apply today.