Summary
QNB is seeking a Manager, IT Security International to support information security governance across its subsidiaries and international branches in Doha. The role covers implementation of the Group Information Security Framework, risk assessment, security reporting, and coordination with business units, auditors and compliance teams. Applicants need at least 6 years of information security experience at a major international bank, with experience across the Three Lines of Defence preferred. A bachelor’s degree and a mandatory CCSP or CISSP certification are required; the role is marked Qatarization.
The posting
As published on qnb.com. Pulled from the employer's site and shown as they wrote it.
Job Summary
The incumbent will assist the Senior Vice President (SVP) of IT Security International in providing oversight, guidance and governance to the QNB Group Subsidiaries in all matters relating to the QNB Group IT Security. The incumbent will be working closely with the IT Security teams and other relevant stakeholders in each of the Subsidiaries and International Branches to provide oversight, guidance and challenge on the deployment of a consistent methodology, approach and execution of Group Information Security policies, standards and practices. The incumbent may undertake risk assessments and promote efficient and prompt communication, interaction and synergies between QNB International Units’ IT Security functions with the various QNB business areas (i.e. Corporate and Institutional Banking, Treasury, Retail, Wealth Management) and support areas (Operations, IT, Services, Communications, Human Capital), as well as Audit, Legal, Group Strategy, Compliance and Financial Control functions (”QNB Divisions”).
Main Responsibilities
A. Shareholder & Financial: - - - - - - -
Support the implementation of the QNB Group Information Security Framework (Polies, Procedures and
standards) with the aim to improve the groups management of its Information Security
Increase the effectiveness of management’s oversight by creating a methodology and list of KPI/KRIs to monitor
the effectivenes or controls and assess the security posture of the entities.
Provide inputs to the Manager of IT Security International to prepare the Information Security Strategy.
Assist the Senior Vice President of IT Security International in preparing the Information Security Strategy that
reflects the Group’s tolerance for risk and present it to the GCRO for discussion/ review.
Promote a strong control culture and general awareness of risk management across the business.
Implements KPI’s and best practices for IT Security International.
Act within the limits of the powers delegated to the incumbent.
B. Customer (Internal & External): - - - - - - - - - - - -
Build and maintain strong and effective relationship with all Support departments and units to achieve the Group’s
goals/ objectives.
Build and maintain strong and effective relationship with all relevant stakeholders in Subsidiaries and International
branches to achieve the Group’s goals/ objectives.
Provide timely and accurate information to the external and internal auditors and the Compliance function as and
when required.
Ensure the pro-active participation and support of QNB International Units in the preparation / updating of policies,
procedures and guidelines.
Ensure that the information security framework is well embedded across the business and functions to ensure
transparency of risks, issues and events.
Regularly contribute presentations to governance committees ensuring the Information Security profile is clearly
reported and understood.
Consolidate portfolio management data/ other Information Security data received from the other Information
Security sub-functions.
Produce adequate and accurate reports pertaining to Information Security.
To assist customers in all their queries on Bank’s product and seek solution to their requests.
Maintain activities in accordance with Service Level Agreements (SLAs) with internal departments/units to achieve
improvements in turn-around time.
Build and maintain strong/effective relationships with related departments/units to achieve the Group’s objectives.
Provide timely/accurate data to external/internal Auditors, Compliance, Financial Control and Risk when required.
C. Internal (Processes, Products, Regulatory): -
Stay updated with the relevant best practice pronouncements pertaining to Information Security and work towards
instilling the same within the Group’s Information Security practices.
- Carry out appropriate on-going evaluation of all systems, processes and infrastructure, to ensure policies,
processes and standards are in place to identify, assess, measure, manage and report Information Securitys,
including identification of the Subsidiaries systemic Information Security. - Escalate relevant Information Security reporting/issues as requested by the VPs and Managers of IT Security
International to include and comply with all internal and/or external requirements. - Assist in the delivery of other projects as mandated by the VPs and Managers of IT Security International
D. Learning & Knowledge: - Possess an understanding of business processes and controls in all related operational areas. - Possess superior knowledge on quantitative techniques to assessing, measuring and managing Information
Security. - Maintain an understanding of all pertinent regulations as well as best practices pertaining to Information Security. - Keep abreast of the latest technical developments in modeling Information Security. - Proactively identify areas for professional development of self and undertake development activities. - Seek out opportunities to remain current with all developments in professional field.
E. Legal, Regulatory, and Risk Framework Responsibilities: - Comply with all applicable legal, regulatory and internal compliance requirements including, but not limited to,
Group Compliance Policies and Procedures (AML & CTF, Sanctions Policy, Data Protection Policy, Fraud Control
Policy, Whistle Blowing Policy, Conflict of Interest and Insider Dealing Policy). - Understand and effectively perform your role under the Three Lines of Defence principle to identify measure,
monitor, manage and report risks. - Ensure systematic good outcomes for clients in accordance with Conduct Risk policy. - Support the framework of RCSA, KRI, Incident reporting and remediation, as appropriate, in accordance with the
Operational Risk Management requirements. - Maintain appropriate knowledge to ensure full qualification to undertake the role. - Complete all mandatory training provided by the Bank, attain, and maintain the required levels of competence. - Attend mandatory (internal and external) seminars as instructed by the Bank.
F. Other: - Ensure high standards of data protection and confidentiality to safeguard commercially sensitive information. - Maintaining utmost confidentiality concerning customer and internal bank information obtained during the course
of business and provide such information on a need to know basis only to Senior Management of QNB, Audit and
Compliance functions, and relevant Regulators. - Maintain high professional standards to uphold QNB's reputation and to strengthen its market leadership position. - All other ad hoc duties/activities related to QNB that management might request from time to time.
Education and Experience Requirements
- Bachelor’s degree preferably with a Major in Marketing, Banking, Finance, Accounting, Economics, Business Administration or Information Technology (related field of study).
- Professional certifications such as CCSP, CISSP is mandatory.
- At least of 6 years’ experience in a major International bank in an Information Security department
- Ideally a mix of both 1st, 2nd and 3rd line experience