Information Security Officer (ISO)

Role Purpose

The Information Security Officer (ISO) will be responsible for developing, implementing, and overseeing the bank’s information security strategy, policies, and controls. The role ensures that the bank’s data, systems, applications, and infrastructure are safeguarded against internal and external threats while meeting local regulatory requirements (QCB, QFCRA, NCSA-Q) and international standards (ISO 27001, NIST, GDPR, PCI-DSS as relevant). Key Responsibilities

Governance & Compliance Establish, maintain, and enforce the bank’s information security framework, aligned with QCB, QFCRA, and local cybersecurity regulations. Ensure compliance with international standards (ISO 27001, NIST CSF, COBIT, PCI-DSS) and conduct regular gap analyses. Prepare and present security risk assessments and reports to senior management, regulators, and the Board Risk Committee. Design, implement, and enforce security policies and procedures to safeguard the bank’s infrastructure and data. Security Operations Oversee Security Operations Center (SOC) activities, incident response, and threat intelligence monitoring. Develop and maintain business continuity, disaster recovery, and incident response plans. Implement and monitor Data Loss Prevention (DLP), intrusion detection / prevention (IDS / IPS), endpoint protection, and other security tools. Lead investigations of security breaches, develop strategies for handling incidents, and ensure lessons learned are integrated into policies and processes. Stay current with the latest security systems, standards, and products to ensure optimal protection. Regularly evaluate the effectiveness of security measures and update them against emerging threats and industry best practices. Conduct regular staff training on security awareness, best practices, and incident procedures. Collaborate with IT and business management to continuously improve security controls and culture. Risk Management Conduct enterprise-wide risk assessments on systems, applications, vendors, and third-party service providers. Identify vulnerabilities and ensure timely remediation through patch management and secure configurations. Work with IT and business units to integrate security into new product initiatives. Vendor & Technology Oversight Evaluate and approve technology vendors, outsourcing partners, and cloud solutions for compliance with security standards. Manage penetration tests, vulnerability assessments, and external audits. Requirements Bachelor’s degree in information security, Computer Science, or related field. Master’s degree preferred. Professional certifications : CISSP or CISM required; CISA and ISO 27001 Lead Implementer preferred. Cloud security certifications (e.g., CCSP, AWS Security) are a plus. 8–12 years in information security, with at least 5 years in the financial-services sector. Strong background in banking systems, digital channels, payment systems, and regulatory environments. Proven experience engaging with regulators (QCB, QFCRA, CMA, or equivalent). Proven experience in implementing SEIM Solutions, managing SOC Team. Expertise in cybersecurity frameworks, network security, cryptography, and identity & access management. Strong risk management and analytical skills. Excellent communication and stakeholder-management skills, capable of engaging effectively with regulators, auditors, and the Board. Ability to influence across departments, build a culture of security, and lead change initiatives without direct authority

#J-18808-Ljbffr