Senior Information Security Manager

Company: Protego (Information Security Services)
Location: Pakistan
Reports to: CTO Protego
Employment Type: Full-time

Protego is an information security services company providing infosec compliance and governance services to clients across regulated industries including financial services fintech banking technology and RegTech.

As Protego scales its service delivery capability you will lead the technical and compliance security practice owning strategy certification services and client delivery with a junior team member supporting day-to-day execution and IT governance tasks.

This is a leadership role for someone who wants to build and run a client-facing security practice balancing hands-on technical delivery with account ownership and service quality.

You will own Protegos security service delivery end-to-end across four service lines focused on:

1. Governance Risk & Compliance (GRC) ISO 27001 certification & ISMS implementation vCISO/Information Security Office as a Service risk assessment & risk register management third-party/vendor risk management and regulatory advisory (SOC 2 ISO 27701 PCI DSS GDPR and local data protection).
2. Technical Assurance penetration testing secure code review cloud security posture assessment architecture & configuration review and vulnerability management.
3. Managed Security & IT Governance outsourced IT governance (license/asset lifecycle) endpoint security monitoring access & identity governance and incident response planning.
4. Advisory virtual CISO retainers and security awareness training.
5. Client & Engagement Management scoping delivery quality reporting relationship ownership across all of the above.

You will also mentor and direct the Junior Information Security Analyst and contribute to Protegos service offering and proposal/scoping work as the client base grows.

• Lead ISO 27001 gap assessments ISMS implementation and certification-readiness consulting for Protegos clients owning the Statement of Applicability risk register and control framework on their behalf.
• Deliver Information Security Office as a Service (vCISO) engagements acting as outsourced security leadership for clients who need the function without a full-time hire.
• Own risk assessment and risk register management for client engagements keeping registers current as client environments change.
• Lead third-party and vendor risk management engagements assessing the risk clients own suppliers introduce.
• Deliver regulatory and framework advisory including GDPR and other data protection regulation compliance (data mapping DPIA support breach-notification readiness) alongside SOC 2 readiness ISO 27701 and PCI DSS scoping.
• Manage relationships with certification bodies on behalf of clients audits surveillance visits recertification.
• Own the policy and documentation templates Protego uses across client engagements and their periodic review.
• Lead responses to client security due diligence and questionnaires on behalf of clients Protego supports.

• Define the pentest strategy and calendar across web API mobile infrastructure and cloud for client engagements.
• Perform or directly oversee execution of tests; review and quality-check findings before reports go to clients.
• Own severity rating methodology (CVSS) client-facing report standards and remediation tracking to closure.
• Establish the secure code review process (manual SAST/DAST) and integrate it into client SDLCs; personally review higher-risk/complex code (auth payments data handling cryptography).
• Deliver cloud security posture assessments (AWS/Azure) and architecture/configuration reviews for client environments.
• Own an ongoing vulnerability management service for clients scanning triage and reporting on a defined cadence not one-off point-in-time reports.
• Manage third-party pentest vendor/subcontractor relationships where independent/certified attestation or surge capacity is required.

• Set IT governance policy (access control MFA patch management vendor risk backup verification) and hold the junior analyst accountable for day-to-day execution both for Protegos own IT and for clients on managed service engagements.
• Own outsourced IT governance as a client-facing managed service license/asset lifecycle management and endpoint security monitoring delivered on a subscription basis.
• Own access and identity governance for client engagements provisioning/de-provisioning and access reviews run on a fixed schedule.
• Own incident response planning and tabletop exercise delivery for clients and act as incident commander when needed.

• Deliver virtual CISO retainer engagements ongoing strategic security leadership for clients on a recurring monthly basis.
• Design and deliver security awareness training programs tailored to client organisations.

• Scope and price security engagements across all four service lines in collaboration with Protego leadership.
• Own client relationships for security engagements kickoffs status reporting findings walkthroughs and renewal/upsell conversations.
• Ensure engagement quality and SLA adherence across concurrent client work.
• Contribute security expertise to proposals RFP responses and sales support as Protegos client base and service catalogue grow.

• Mentor and manage the Junior Information Security Analyst; delegate governance/administrative tasks appropriately.
• Report security posture risk engagement pipeline and delivery quality to Protego leadership.

• 6 years in information security with strong hands-on depth in at least three of: compliance/ISMS/GRC pentesting secure code review IT governance.
• Proven experience implementing/maintaining an ISO 27001 ISMS; Lead Implementer or Lead Auditor certification strongly preferred.
• Working knowledge of GDPR and data protection regulation (data mapping DPIA breach notification) sufficient to advise clients and scope engagements.
• Solid penetration testing background OSCP CEH or equivalent preferred.
• Familiarity with secure code review tooling and practices (OWASP Top 10 SAST/DAST).
• Comfortable operating in a vCISO / outsourced security leadership capacity advising client leadership directly not just executing tasks.
• Strong stakeholder communication able to brief executives and mentor junior staff.
• Experience in a regulated industry (fintech RegTech banking) is a strong plus given Protegos client base.
• Experience delivering security services or consulting to external clients (as opposed to purely internal security work) including scoping engagements managing client expectations and producing client-ready deliverables.

• Prior experience in a security consultancy MSSP or professional services environment.
• Cloud security experience (AWS/Azure) including cloud security posture assessment.
• Experience with SOC 2 ISO 27701 or PCI DSS scoping.
• Scripting/automation skills (Python Bash).
• Exposure to proposal writing SOW drafting or pre-sales technical support.

• ISMS scoping and gap assessments delivered for Protegos first client engagements with a clear path mapped to ISO 27001 certification/recertification for each.
• At least one vCISO or GDPR advisory engagement scoped and running.
• Pentest and secure code review programs running on a defined cadence for client engagements with tracked remediation.
• IT governance and managed security policies defined with the junior analyst operating effectively against them both internally and on at least one client managed-service engagement.
• Documented incident response plan tested at least once either internally or with a client.
• Clear service catalogue and pricing model established across all four service lines (GRC Technical Assurance Managed Security & IT Governance Advisory).

Market-competitive salary with the option for ESOPs (Employee Stock Ownership Plan).

Protego is an equal opportunity employer. We welcome applications from candidates of all backgrounds.