Manager – Enterprise Security

About the Organization

Our client is a Leading Diversified Conglomerate with a significant presence across multiple industries in Sri Lanka. The organization is committed to digital excellence and the highest standards of data integrity. As they continue to expand their digital footprint, they are looking for a visionary leader to establish and maintain a robust information security management program to protect their corporate assets and those of their group entities.

About the Role

The Manager – Enterprise Security is a high-impact leadership role responsible for the availability, integrity, and confidentiality of business and customer information. You will be the primary process owner for IT risk, governance, and compliance management. This role requires a blend of business acumen and deep technical security knowledge to translate organizational constraints into technical control requirements, ensuring the group remains resilient against evolving cyber threats.

Location: Colombo, Sri Lanka

Key Responsibilities

1. Security Strategy & Governance

Framework Management: Develop and implement a corporate-wide Information Security Management Framework and supporting procedures.
Risk Assessment: Lead information security risk assessments and oversee internal and external audits to ensure compliance with regulatory requirements.
Strategy Alignment: Identify information security objectives that align with the corporate strategic plan and the organization's risk posture.
Incident Response: Overlook the incident response architecture, managing SIEM, EDR, and third-party vendor relationships for breach investigations and forensics.

2. Operational Security & Vulnerability Management

Vulnerability Management: Drive the fix of critical and high vulnerabilities across group assets and platform assets.
Audit & Compliance: Carry out periodic security audits for Data Centers (iDC) and Cloud environments (Azure), providing recommendations based on industry best practices.
Reporting: Prepare technical specifications, VA reports, and maintain an issue tracker for bug fixing and risk mitigation.

3. Training & Knowledge Leadership

Awareness Programs: Manage the implementation of interactive security training and awareness programs for all staff levels.
Continuous Learning: Maintain an up-to-date knowledge base regarding security advisories, alerts, and emerging global trends in cyber security.

Candidate Profile

Experience & Qualifications

Overall Experience: Minimum of 7 years in the IT industry.
Domain Expertise: At least 5 years of experience in the Information Security domain, including a minimum of 2 years in a managerial capacity.
Education: B.Sc. degree in Information Systems or an equivalent qualification.
Professional Certifications: Possession of CISA, CISM, or CISSP is required. Certifications in Software Security (VAPT) will be a distinct advantage.

Technical Skills

Security Testing: Proficiency in Software Vulnerability Assessment & Penetration Testing (VAPT) using tools such as Nessus, Metasploit, Kali, or Burpsuite.
Frameworks: Strong awareness of OWASP, SANS, WASC, and Secure SDLC standards.
Cloud & SIEM: Experience with IaaS offerings (Azure/AWS) and SIEM platforms for monitoring and troubleshooting.

Attributes

Strategic Acumen: Ability to translate IT risk requirements into business-aligned technical specifications.
Communication: Exceptional verbal and written skills with the ability to interact with staff and stakeholders at all levels.
Leadership: A proactive, energetic leader who takes accountability for results and maintains a positive attitude under stress.

Manager - Enterprise Security