Manager – Cyber & InfoSec Operations

The Manager – Cyber & Information Security (Info Sec) Operations supervises the bank’s cyber defense operations, ensuring timely detection, response, and resolution of security incidents. He/ She operates incident handling, digital forensics, and third-party cybersecurity coordination while maintaining compliance with regulatory and internal security frameworks. The role supports key operational security controls, drives continuous improvements in threat response, and collaborates with stakeholders to safeguard the bank’s information assets across platforms and vendors.

• Manages the full lifecycle of cybersecurity incident response including detection, triage, containment, eradication, recovery, and post-incident review.
• Conducts Root Case Analysis (RCA) [HH1] of compromised systems and preserves digital evidence for compliance and legal use.
• Updates and tests the incident response plan and playbooks to ensure readiness.
• Investigate security incidents such as unauthorized access, insider threats, and external attacks.
• Interfaces with MSSPs and third-party vendors for alert triage, escalation, and monitoring performance.
• Optimizes SIEM rules, detection logic, and response workflows with vendors and internal teams.
• Conducts regular meetings with vendors to review SLAs, resolve issues, and improve service levels.
• Evaluates emerging cybersecurity technologies and engages with vendors to enhance capabilities.
• Conducts risk assessments, vulnerability scans, and penetration testing to identify and mitigate threats.
• Implements and maintains the Bank’s information security program in compliance with regulatory and business standards.
• Develops and enforces cybersecurity policies, standards, and procedures in alignment with frameworks (ISO 27001, CBO, MTCIT).
• Manages ISO 27001 certification efforts and maintains ISMS documentation and audit readiness.
• Maintains the cybersecurity risk register, audit findings, and remediation tracking.
• Performs user access reviews and privileged access reviews for critical systems in compliance with RBAC and regulatory requirements.
• Manages enforcement of PAM controls and maintains evidence of periodic access reviews.
• Approves firewall, system, and administrative access changes as the designated ISO authority.
• Coordinates with HR to manage onboarding and offboarding access controls for staff, vendors, and contractors.
• Provides security input for new IT and business projects, ensuring risk mitigation is embedded in solution design.
• Conduct security assessments, architectural reviews, and integration support for new systems.
• Communicates incident updates, risks, and resolutions to stakeholders across IT, Legal, Compliance, and Business Units.
• Develops and delivers cybersecurity awareness and training programs to staff.
• Fosters a culture of accountability, proactive defense, and information security ownership.
• Leads cyber drill simulations and incident response exercises to improve response capabilities.
• Ensures compliance with data protection regulations and internal privacy policies.
• Develops and maintains privacy notices, consent forms, and data handling procedures.
• Manages data subject access requests and leads investigations into privacy-related incidents.
• Acts as the main liaison with Data Protection Authorities during audits or investigations.
• Executes the information security roadmap aligned with enterprise risk strategy.
• Ensures ongoing adherence to cybersecurity best practices, regulatory mandates, and corporate security policies.
• Maintains high standards of professionalism, accuracy, and integrity in all operational duties.
• Collaborates with internal functions to sustain an enterprise-wide security and privacy posture.
• Ensures incident reports, root…