Data Security Manager

About HSBC:

HSBC Saudi Arabia provides investment banking services to the full spectrum of corporate and institutional clients in both the private and government sectors, including public companies; private companies and establishments; funds; government agencies; and family businesses and offices

Role Purpose (overall high-level summary of the role)

The role holder is responsible for developing, implementing and monitoring adherence to information security policies and procedures in HSBC SA business operations. The role holder is also responsible for creating awareness on security risks and potential fraud within the businesses, and for the Business Continuity Risk Management (BCM) As part of SMART IT Segregation the role holder is also responsible for Data Security.

• The role holder is responsible for all aspects of Information Security Risk across the HSBC Saudi Arabia. This includes Data Security, Threat & Incident Management, Business Controls, Third Party Security and Technical Security. The role holder is responsible for all aspects of technical security including but not limited to facilitation and interpretation of infrastructure security and application security, and operating access management controls.
• The role of the Manager Information Security Risk is to assist the HSBC SA business and IT with ensuring that their critical services have been subject to adequate due diligence, relevant risks (e.g. Cyber and resilience risks) are captured and risk impact is evaluated according to HSBC risk framework, technology and business functions understand their risk, the continued and ongoing effectiveness of their security control environment to inform their risk decision making (e.g. going live with projects) via adequate metrics so the business can manage their risk against their risk appetite.
• The role holder will be part of a team, which provides support to the CISO and CRO with the design and execution of the Cyber security strategy.
• The role holder will also advise all parties involved in the management and operations of security controls around HSBC SA services critical services and take forward security improvements and remediation activities. The consultant will also advise and support to HSBC SA IT Teams, liaise and co-ordinate with security teams who conduct application security risk assessments and manage security controls on our behalf. Assess / check the technical security solutions to ensure that HSBC SA is not un-necessary exposed to any risks and that all risks are (in the process of being) mitigated within the risk appetite as set by the HSBC SA management.
• The ideal candidate will have deep technical understanding of security controls and come from a hands on technical background, strong stakeholder management skills and a desire to develop and learn. Certifications such as CISSP, CISM or equivalent is not essential but desirable.

Principal Accountabilities:

Key activities and decision-making areas

• Own and lead the implementation, operation, and continuous improvement of data security controls, ensuring the confidentiality, integrity, and availability of organizational data across all environments.
• Operate and manage data security technologies and platforms (e.g., DLP, data classification, encryption, discovery, and monitoring tools), including configuration, tuning, enhancement, and ongoing optimization of controls.
• Monitor, detect, and trigger response to data security incidents, ensuring timely escalation, investigation, coordination with SOC/IR teams, and post-incident analysis in alignment with incident management processes.
• Develop, generate, and enhance data security reporting and dashboards, providing actionable insights, risk analysis, trends, and control effectiveness metrics for technical teams and senior management.
• Ensure alignment of data security controls with applicable standards, regulatory requirem