InfoSec Compliance & Assurance Lead - Banking
Location: Cairo, Egypt (100% On-Premise)
Employment Type: Contract
About us:
Where elite tech talent meets world-class opportunities!
At Xenon7, we work with leading enterprises and innovative startups on exciting, cutting-edge projects that leverage the latest technologies across various domains of IT including Data, Web, Infrastructure, AI, and many others. Our expertise in IT solutions development and on-demand resources allows us to partner with clients on transformative initiatives, driving innovation and business growth. Whether it's empowering global organizations or collaborating with trailblazing startups, we are committed to delivering advanced, impactful solutions that meet today’s most complex challenges.
About the Client:
Join one of Egypt’s premier financial institutions, renowned for its extensive suite of banking services, including Institutional Banking, Personal Banking, and Islamic Banking. With a global presence through over 50 branches and correspondents, we serve a diverse and dynamic clientele. As we embark on a groundbreaking digital transformation journey, we are committed to leveraging the latest technologies to establish a state-of-the-art data architecture that will redefine our performance and service delivery.
Job Summary:
This role exists to accelerate the information security compliance posture across IT and Digital Transformation. The specialist acts as the InfoSec function's technical compliance arm—tracking, evidencing, and reporting on remediation progress against CBE Cybersecurity Framework requirements, PCI DSS obligations, and internal control commitments. The role also leads and executes assurance exercises, either directly or by scoping and managing third-party security assessment engagements.
Key Responsibilities:
A. IT & Digital Transformation Compliance Follow-Up
• Maintain a live compliance tracker across all active CBE Cybersecurity Framework control domains (IAM,
PAM, GRC, Container Security, and others).
• Conduct regular technical walk-throughs with IT and Digital Transformation teams to validate
implementation status and close evidence gaps.
• Escalate risks and blockers to the Head of GRC and CISO with clear risk-quantified language suitable for
Risk Committee reporting.
• Map remediation actions to OKR key results and track delivery against agreed timelines.
• Prepare compliance status reports in a format suitable for senior management and regulatory audiences.
B. PCI DSS Engagement Lead
• Own the end-to-end PCI DSS engagement cycle — scoping, gap assessment, remediation tracking, QSA
coordination, and Report on Compliance (RoC) or Self-Assessment Questionnaire (SAQ) readiness.
• Coordinate across IT, Operations, and Digital to ensure cardholder data environment (CDE) controls are
implemented, evidenced, and maintained.
• Manage the relationship with the appointed Qualified Security Assessor (QSA) and act as the internal
point of contact throughout the assessment cycle.
• Drive closure of PCI DSS findings and build a compensating controls register where technical controls are
not yet feasible.
• Maintain PCI DSS documentation library including network diagrams, data flow diagrams, asset inventory,
and policies relevant to the CDE.
C. InfoSec Assurance Exercises
• Plan and execute assurance activities including control testing, configuration reviews, access reviews,
and policy compliance spot checks.
• Scope, procure, and manage third-party security assessment vendors where specialized assessment
capability is required (e.g., penetration testing, red team exercises, cloud security reviews).
• Produce clear assurance reports with risk-rated findings, business impact statements, and prioritized
remediation recommendations.
• Track finding remediation to closure and validate effectiveness of corrective actions.
• Coordinate with the InfoSec Control Validation Manager to align assurance outputs with
broader control validation programme.
Requirements
• Minimum 7 years of information security experience, with at least 3 years in a banking or financial
institution.
• Hands-on PCI DSS experience — must have participated in or led at least one full RoC or SAQ-D
assessment cycle.
• Deep knowledge of CBE Cybersecurity Framework requirements and Egyptian regulatory context.
• Experience conducting technical compliance gap assessments across IT infrastructure, network, and
application layers.
• Strong written and verbal communication skills in both Arabic and English.
Preferred Certifications
• CISA — Certified Information Systems Auditor
• PCIP or PCI ISA — PCI Internal Security Assessor
• ISO 27001 Lead Auditor
• CISM — Certified Information Security Manager
Preferred Experience
• Prior experience in an Egyptian bank or financial institution operating under CBE oversight.
• Familiarity with GRC tooling (RSA Archer, ServiceNow GRC, or equivalent).
• Experience working with external auditors, QSAs, and regulators.
Benefits
- Attractive, market-leading salary package
- Clear career advancement path with professional development opportunities
As published by workable
First name, Last name, Email, Phone, Address, Photo, Education, Experience, Summary, Resume, Cover letter
- This is a full-time independent contractor position. Please note that this role is strictly 'compensation-only' and does not include social insurance, medical coverage, paid leave, or paid public holidays. Are you comfortable proceeding with an agreement on these terms? yes / no
- Could you share an overview of your experience in information security, including how many years you've been working in this field and some highlights from your career? written answer
- What experience do you have working in information security within banking or financial institutions? Please describe your roles and responsibilities during this time. written answer
- This is a hybrid model job, Are you located in Egypt and able to work in 4 days per week on-Site in New Cairo and one day from home? yes / no
- Can you describe your hands-on experience with PCI DSS, including any involvement in RoC or SAQ-D assessment cycles? What was your role and what were the outcomes? written answer
- Based on the above what is your expected monthly salary in EGP (gross, all-inclusive)?
- Could you tell us about your experience conducting technical compliance gap assessments across IT infrastructure, network, and application layers? What approaches or tools have you used? written answer
- How many years of total professional experience do you have in Information Security, Risk, or IT?
- What is your proficiency level in Arabic? choose one
- What is your proficiency level in English? choose one
- How many years of experience do you have working within a banking or regulated financial institution?
- Have you actively participated in or led at least one full PCI DSS Report on Compliance (RoC) or SAQ-D assessment cycle? yes / no
- Do you possess deep working knowledge of the Central Bank of Egypt (CBE) Cybersecurity Framework requirements? yes / no
- What is your notice period in days?