Chief Information Security Officer

Commercial Bank of Ceylon PLC (CBC), founded in 1920, is a leading commercial bank of Sri Lanka, listed on the Colombo Stock Exchange. With numerous accolades from Euromoney, The Banker, etc., 16 consecutive years of AAA credit rating and a strong presence in Bangladesh, CBC is seeking a candidate for the role of Chief Information Security Officer (CISO). The primary responsibility of this role is to oversee and manage the Information Security Management System (ISMS) for the Bank and it involves leading the development, implementation, and continuous improvement of policies, frameworks, and strategies to ensure the comprehensive protection of the entity's information assets.Job Profile:Governance Implementation: Establish and maintain a robust information security governance framework for the organization that supports sound decision-making and accountability.Policy & Procedures: Develop, publish and maintain the information security policies, processes and high-level procedures that implement Group standards and satisfy regulatory requirements relevant to the entity.Local Strategy & Roadmap: Implement the organization's information security strategy and roadmap in alignment with the Group's priorities and maturity targets, adapting to local market and technology conditions.Controls Implementation: Deploy and operate security controls and procedures that meet organizational standards.Compliance Management: Ensure ongoing compliance with applicable Laws, Regulations, and internal security requirements and support regulatory examinations.Assessment and Assurance: Plan and conduct security audits, vulnerability assessments and technical testing; advice on corrective actions, track remediation and validate effectiveness.Risk Management: Lead the information security risk management programme for the entity in accordance with Group requirements and regulatory obligations.Incident Management: Develop and maintain a comprehensive Information Security Incident Management and Response Framework, covering incident detection and reporting, escalation procedures, analysis, containment, remediation, and the implementation of corrective and preventive actions.Threat Monitoring & Dashboards: Develop and maintain threat dashboards and related security dashboards to monitor and report on the organization's security posture.Awareness & Training: Coordinate the design and delivery of security awareness, role-based training and exercises to build and sustain a security culture.Reporting & Escalation: Report on security posture, significant incidents, residual risks and control effectiveness to local management and the Group CISO as required.Coordination with Group: Work collaboratively with Group CISO function to ensure consistent control implementation across the Group.Applicant's Profile:Education: Minimum Bachelor’s degree in information security, IT, or a related discipline from a recognized university.Professional Certification: Recognized certifications such as CISSP, CISM, or equivalent is preferred.Experience: Minimum 7 years of working experience in information security management or related domains with at least 3 years in a leadership / supervisory role managing security teams or frameworks.Ready to take the next step? Apply with your updated CV by 11 November 2026.