IS Compliance Supervisor

Job Responsibilities

• Maintain the information security compliance framework, obligations register, and control assessment schedule.
• Assess compliance with applicable Central Bank of Iraq requirements, contractual obligations, and the Bank’s information security policies.
• Coordinate relevant activities relating to ISO/IEC 27001, PCI DSS, and COBIT 2019.
• Develop and review information security policies, standards, procedures, and control requirements.
• Conduct security risk and control assessments, documenting gaps, recommendations, and remediation priorities.
• Maintain audit and compliance findings register, follow up with action owners, and validate closure evidence.
• Coordinate evidence collection for internal audits, external assessments, and regulatory reviews.
• Assess third-party security compliance and follow up on identified control gaps.
• Review evidence for controls such as access management, vulnerability management, change management, data protection, and incident handling.
• Prepare compliance dashboards and management reports, escalating overdue actions and significant exposures.
• Support security awareness activities and guide staff involved in compliance work.
• Supervise daily information security operations, assign priorities, and follow up on operational tasks and escalations.
• Oversee security monitoring, alert investigation, and incident response in coordination with internal teams and security service providers.
• Coordinate incident containment, recovery, evidence preservation, and root cause analysis under approved response procedures.
• Oversee the configuration, health, and effectiveness of security platforms, including SIEM, endpoint protection, PAM, NAC, MFA, and other deployed controls.
• Review security use cases, detection rules, and alert thresholds to improve detection and reduce false positives.
• Coordinate vulnerability assessments and track remediation with application, infrastructure, and system owners.
• Review security configurations, hardening measures, and security exceptions; escalate significant exposures.
• Maintain operational playbooks, escalation procedures, security platform inventories, and activity records.
• Monitor service provider performance, support arrangements, and security technology licensing and support expiry dates.
• Prepare management reports covering incidents, vulnerabilities, control effectiveness, and overdue actions.
• Support disaster recovery exercises, security testing, and audit evidence requirements.
• Implement and monitor applicable CIS Controls, including access security, vulnerability management, audit logging, malware protection, and incident response.
• Coordinate hardening assessments against Bank-approved baselines based on CIS Benchmarks for operating systems, databases, network devices, and other applicable technologies.
• Align security monitoring, detection, response, and recovery activities with relevant NIST CSF 2.0 outcomes.
• Identify operational control gaps, coordinate remediation with system owners, verify corrective actions, and maintain supporting evidence.
• Work with the Information Security Compliance team to support framework assessments and report operational control effectiveness.

Qualifications and Experience

• Bachelor’s degree in Information Security, Information Technology, Computer Science, or a related discipline.
• At least five years of relevant experience in information security, technology risk, compliance, or IT audit, including experience coordinating assessments or leading workstreams.
• Banking or financial services experience is strongly preferred.
• Working knowledge of ISO/IEC 27001, PCI DSS, COBIT 2019, and applicable banking regulatory requirements.
• Ability to evaluate technical controls and assess supporting evidence.
• Strong policy writing, risk assessment, reporting, and stakeholder management skills.
• Hands-on experience with SIEM, EDR/XDR, security incident investigation, and vulnerability management.
• Strong understanding of network security, Windows and Linux security, Active Directory, privileged access, and authentication controls.
• Ability to analyze logs, investigate suspicious activity, and coordinate effective incident response.
• Practical experience applying CIS Controls and CIS Benchmarks, including configuration assessments, remediation tracking, and exception management.
• Working knowledge of NIST CSF 2.0 and the ability to translate relevant outcomes into operational procedures, monitoring activities, and measurable improvements.
• CISA, CISM, CRISC, or ISO/IEC 27001 Lead Implementer/Lead Auditor certification is preferred.
• Strong professional English communication and documentation skills.