IS Compliance Supervisor

Job Responsibilities Maintain the information security compliance framework, obligations register, and control assessment schedule. Assess compliance with applicable Central Bank of Iraq requirements, contractual obligations, and the Bank’s information security policies. Coordinate relevant activities relating to ISO/IEC 27001, PCI DSS, and COBIT 2019. Develop and review information security policies, standards, procedures, and control requirements. Conduct security risk and control assessments, documenting gaps, recommendations, and remediation priorities. Maintain audit and compliance findings register, follow up with action owners, and validate closure evidence. Coordinate evidence collection for internal audits, external assessments, and regulatory reviews. Assess third-party security compliance and follow up on identified control gaps. Review evidence for controls such as access management, vulnerability management, change management, data protection, and incident handling. Prepare compliance dashboards and management reports, escalating overdue actions and significant exposures. Support security awareness activities and guide staff involved in compliance work. Supervise daily information security operations, assign priorities, and follow up on operational tasks and escalations. Oversee security monitoring, alert investigation, and incident response in coordination with internal teams and security service providers. Coordinate incident containment, recovery, evidence preservation, and root cause analysis under approved response procedures. Oversee the configuration, health, and effectiveness of security platforms, including SIEM, endpoint protection, PAM, NAC, MFA, and other deployed controls. Review security use cases, detection rules, and alert thresholds to improve detection and reduce false positives. Coordinate vulnerability assessments and track remediation with application, infrastructure, and system owners. Review security configurations, hardening measures, and security exceptions; escalate significant exposures. Maintain operational playbooks, escalation procedures, security platform inventories, and activity records. Monitor service provider performance, support arrangements, and security technology licensing and support expiry dates. Prepare management reports covering incidents, vulnerabilities, control effectiveness, and overdue actions. Support disaster recovery exercises, security testing, and audit evidence requirements. Implement and monitor applicable CIS Controls, including access security, vulnerability management, audit logging, malware protection, and incident response. Coordinate hardening assessments against Bank-approved baselines based on CIS Benchmarks for operating systems, databases, network devices, and other applicable technologies. Align security monitoring, detection, response, and recovery activities with relevant NIST CSF 2.0 outcomes. Identify operational control gaps, coordinate remediation with system o