Information Security GRC Analyst

Opportunity Information

The Role

To strengthen Raqami’s governance, risk, and compliance posture by assessing security configurations and controls, validating compliance with ISO/ IEC 27001:2022, PCI DSS, and SBP regulatory requirements, tracking remediation of audit findings and control gaps, and coordinating audits, ensuring information security risks are identified, managed, and reported in line with Raqami’s policies and regulatory obligations.

•Conduct periodic security configuration and baseline hardening assessments of servers, databases, endpoints, network devices, and applications against approved security standards and CIS Benchmarks •Validate applicable ISO/ IEC 27001:2022 controls, maintain compliance evidence, and support internal audits, external audits, and certification surveillance activities •Assess applicable PCI DSS controls, validate security requirements, coordinate evidence collection, and track remediation of identified compliance gaps •Map applicable SBP regulatory requirements to internal controls, validate implementation, maintain compliance records, and track regulatory observations •Perform periodic security control assessments to evaluate control design, implementation, and operating effectiveness, documenting gaps and recommending corrective actions •Maintain a centralized tracker for audit findings, regulatory observations, control deficiencies, action owners, target dates, risk ratings, and closure status •Coordinate with relevant IT and business teams to remediate identified gaps, validate closure evidence, and escalate overdue or high-risk findings •Monitor security vulnerabilities, patching gaps, configuration deviations, and unsupported systems, ensuring remediation is tracked according to approved risk priorities •Document control exceptions, assess associated risks, maintain risk registers, and track approved risk treatment plans in coordination with relevant stakeholders •Coordinate with Internal Audit, external auditors, certification bodies, and PCI DSS assessors to facilitate assessments and maintain accurate, traceable audit evidence •Prepare periodic management reports highlighting compliance status, hardening coverage, open and overdue findings, remediation progress, and significant control deficiencies

Applicants General Eligibility & Requirements

Education, Experience and Skills Requirements