GRC & Information Security Manager

Key Responsibilities:

• Lead the organization's Governance, Risk, and Compliance (GRC) and Information Security governance framework.
• Develop and maintain Information Security policies, standards, procedures, and controls.
• Own compliance programs covering PCI-DSS, PCI-PIN, PCI-3DS, PCI-MPoC, SOC 2 Type II, ISO 27001, and other applicable standards.
• Ensure compliance with Central Bank of Egypt (CBE) requirements, regulatory obligations, and applicable local and international regulations.
• Manage and ensure timely completion of Information Security/GRC questionnaires and assessments from local and global partners, banks, customers, and stakeholders, including evidence gathering and remediation.
• Lead internal and external audits, regulatory assessments, PCI assessments, SOC 2 audits, and security assessments.
• Manage internal control compliance reviews, audit findings, and remediation activities.
• Conduct enterprise, technology, operational, and third-party risk assessments and maintain risk registers.
• Define risk treatment plans, monitor remediation, and escalate critical or overdue risks.
• Establish and monitor Key Performance Indicators (KPIs), Key Risk Indicators (KRIs), compliance metrics, and management reporting.
• Ensure continuous compliance through regular PCI checkpoints, control reviews, evidence collection, and assessments.
• Govern Vulnerability Assessment and Penetration Testing (VAPT), vulnerability management, and security remediation activities.
• Oversee Security Operations Center (SOC)/SOC-as-a-Service L1/L2/L3 governance, including Service Level Agreements (SLAs), KPIs, escalation, monitoring, and reporting.
• Manage third-party/vendor risk, security assessments, compliance reviews, and remediation.
• Govern Business Continuity, Disaster Recovery, and IT resilience programs.
• Oversee Information Security incident governance, escalation, root-cause analysis, and corrective actions.
• Ensure security and compliance requirements are embedded into projects, applications, infrastructure, cloud, and technology changes.
• Maintain audit-ready policies, risks, controls, certifications, evidence, findings, and compliance documentation, and promote security awareness across the organization.

Qualifications:

• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Risk Management, or a related field.
• 10–12 years of experience in GRC, Information Security, Cybersecurity, Risk, Compliance, or Audit within Fintech or Banking sectors.
• Proven management and leadership experience in GRC and Information Security.
• Strong experience in FinTech, Banking, Payments, or regulated environments.
• Strong hands-on knowledge of various PCI certifications and PCI compliance management.
• Practical knowledge of PCI PIN, PCI 3DS, and PCI MPoC requirements.
• Strong experience with SOC 2 Type II compliance and audit preparation.
• Proven experience developing and governing Information Security policies, procedures, standards, and control frameworks.
• Strong knowledge of Enterprise Risk Management and Information Security Risk Management.
• Proven experience managing internal and external audits, regulatory assessments, and compliance programs.
• Strong experience with Vulnerability Assessment, Penetration Testing, and remediation management.
• Understanding of SOC/SOCaaS L1/L2/L3 operations, Security Information and Event Management (SIEM), incident escalation, SLAs, and KPIs.
• Experience in third-party/vendor security and risk management.
• Strong understanding of Business Continuity, Disaster Recovery, Business Impact Analysis (BIA), Recovery Time Objective (RTO), and Recovery Point Objective (RPO).
• Good knowledge of security controls across cloud, infrastructure, networks, applications, databases, and Identity and Access Management (IAM).
• Experience preparing CBE/regulatory submissions and Information Security questionnaires for local and international partners and customers.
• Strong communication skills for interacting with stakeholders, auditors, vendors, partners, and senior management.
• CISA, CISM, CISSP, CRISC, ISO 27001, or relevant PCI certifications are highly preferred.