Job Description:

Role Purpose

Support the Bank's information security governance, risk, compliance and assurance activities by monitoring applicable requirements, coordinating assessments and audits, maintaining policies and records, tracking corrective actions and preparing clear management and regulatory reporting.

Key Responsibilities

1. Regulatory and Internal Compliance

• Monitor applicable information security and cyber security requirements issued by regulators, government bodies, payment networks and other competent authorities.
• Assess applicability with relevant stakeholders, record obligations and coordinate implementation and evidence collection.
• Maintain compliance trackers and support timely, accurate responses to advisories, questionnaires, inspections and regulatory submissions.
• Escalate overdue, incomplete or potentially non-compliant items through the prescribed governance process.

2. Audit and Assurance Coordination

• Coordinate internal, external, information systems, regulatory and other security-related audits and assessments.
• Collate evidence, verify completeness, maintain an audit trail and coordinate responses with accountable owners.
• Track observations, management actions and target dates through closure and validate the supporting closure evidence.
• Identify recurring themes and support improvements to controls, processes and documentation.

3. Policy, Standards and Exception Management

• Support preparation, review, approval, communication and periodic updating of information security policies, standards, procedures and guidelines.
• Maintain document-control information, review schedules, approval records and version history.
• Coordinate policy exceptions and risk-acceptance requests, ensuring justification, compensating controls, approvals and validity periods are recorded.
• Promote consistent alignment between documented requirements and operational practices.

4. Risk, Metrics and Governance Reporting

• Support cyber and technology risk assessments and maintenance of risk registers, treatment plans and residual-risk records.
• Monitor key risk indicators, compliance metrics, audit status and action-plan progress.
• Prepare concise dashboards, management information and committee papers with validated data and clear status commentary.
• Maintain organized, retrievable and audit-defensible records for governance and assurance activities.

5. Coordination and Awareness

• Coordinate with technology, business, risk, legal, audit and service-provider teams to close compliance requirements.
• Support information security awareness, policy communication and role-based training activities.
• Provide guidance on evidence expectations, control ownership and compliance documentation without assuming the control owner's accountability.