Chief Information Security Officer (CISO)

Colombo, Sri Lanka
Fulltime

About Client Partner

Our client partner is a premier enterprise within the regulated banking, financial services, and telecommunications sector. Operating extensive digital channels, cloud environments, and core technology infrastructure, the organization is committed to providing robust, compliant, and resilient digital services. They offer an executive leadership environment for an accomplished security leader to drive enterprise cybersecurity governance, technology risk management, and digital resilience.

About the Role

We are seeking a visionary, highly accomplished Chief Information Security Officer (CISO) to provide strategic leadership and complete oversight of the organization’s information and cybersecurity framework. In this executive position, you will establish and maintain an enterprise-wide information security strategy to protect information assets, customer data, and technology platforms against evolving cyber threats while ensuring strict alignment with regulatory requirements, recognized standards, and business objectives.

Responsibilities

Strategy & Governance: Formulate and execute the enterprise information security strategy in alignment with business risk appetite, periodically reporting cybersecurity posture and material risks to Senior Management and Board committees.
Cyber Risk Management: Identify, assess, and monitor information security risks across the enterprise, maintaining risk registers and ensuring significant exposures are escalated and remediated.
Security Architecture & Controls: Oversee robust security controls across networks, applications, databases, endpoints, and cloud environments, enforcing identity and access management, privileged access, encryption, and secure configurations.
Threat & Incident Management: Direct continuous security monitoring, vulnerability assessments, penetration testing, threat intelligence, and lead the cybersecurity incident-response framework during containment, recovery, and post-incident reviews.
Data Protection & Compliance: Ensure protection of sensitive customer, employee, and corporate data throughout its lifecycle, coordinating regulatory examinations, internal/external audits, and compliance with sector-specific cybersecurity standards.
Third-Party & Vendor Security: Establish security requirements, risk assessments, and contractual obligations for technology vendors, cloud service providers, outsourced partners, and FinTech integrations.
Resilience & Secure Development: Partner with technology and business continuity teams to enhance cyber resilience, secure system backups, and embed security-by-design principles into new products and technology projects.
Awareness & Team Leadership: Drive enterprise-wide security awareness programs and lead the Information Security function, overseeing Security Operations Centre (SOC) activities and developing team competencies.

Requirements

Educational Qualifications: Bachelor’s Degree in Information Security, Cybersecurity, Computer Science, Information Technology, Engineering, Business Administration, Marketing, or Finance / Management Accounting. A Master’s Degree in Cybersecurity, Information Security, IT, or Business Administration is considered an added advantage.
Years of Experience: Minimum 10 to 15 years of progressive experience in Information Security, Cybersecurity, Technology Risk, or IT Governance, with at least 5 years in a senior managerial or leadership role.
Industry Background: Essential background within Banking, Financial Services, or Telecommunications.
Professional Certifications: Recognized credentials such as CISSP, CISM, CRISC, CCISO, or ISO/IEC 27001 Lead Implementer/Auditor are highly advantageous.
Frameworks & Expertise: Sound exposure to recognized information security standards including ISO/IEC 27001, NIST Cybersecurity Framework, cloud security, SOC operations, identity access management, and vulnerability remediation.
Executive Leadership: Demonstrated ability to present complex risk profiles to Board-level committees, lead multidisciplinary security teams, and collaborate across Legal, Risk, Compliance, and Audit functions.

Chief Information Security Officer (CIS...