Database Security Analyst & Application Security Analyst

National Bank of Pakistan (NBP) is seeking talented, dedicated and experienced professionals for Risk Management based in Karachi for the following positions: Database Security Analyst (OG-I) and Application Security Analyst (OG-II / OG-I).

Database Security Analyst (OG-I) Responsibilities: To implement and enforce database security policies, standards and controls in alignment with State Bank of Pakistan regulations and the Bank's Information Security policies; to manage database access controls and user privileges by applying the principles of least privilege and Role-Based Access Control (RBAC); to monitor database logs, security events and alerts through designated security tools to detect suspicious, unauthorized or anomalous database activities; to conduct database vulnerability assessments and ensure implementation of database hardening measures, secure configurations and security best practices; to coordinate with IT Infrastructure and Database Administration (DBA) teams for timely deployment of security patches, updates and remediation of identified vulnerabilities; to ensure implementation and effectiveness of data protection controls including encryption, data masking, tokenization, database constraints and secure backup management; to respond to database security incidents, support forensic investigations and facilitate evidence collection while ensuring compliance with incident response procedures; to review database architecture, design changes and configuration modifications to ensure compliance with security standards; to support Disaster Recovery (DR) and Business Continuity Planning (BCP) initiatives by validating secure, reliable and compliant database backup and recovery processes; to prepare and present database security reports, dashboards and Management Information System (MIS) reports for the CISO, senior management, internal and external audits; to collaborate with Information Security, IT Operations, Application Development, Risk Management and Compliance teams to strengthen the Bank's database security posture; to review changes to existing databases including database scripts, schema changes, stored procedures, queries and associated security implications; to review restoration of production databases into non-production environments including authorization, access controls, data masking/sanitization, encryption and other security controls; and to perform any other assignment assigned by the supervisor(s).

Application Security Analyst (OG-II / OG-I) Responsibilities: To review architecture of business applications, identify security design level flaws and suggest their remediations; to support and ensure Secure Software Development Life Cycle is being followed within the organization; to perform vulnerability assessments and offensive security testing (white/grey/black box testing) of business application infrastructure, network architecture, web applications & APIs, mobile applications (Android/iOS) and cloud environments periodically; to review changes in application architecture/code and perform security testing SAST/DAST/IAST where applicable; to track application security issues, their remediation process and prepare/update MIS accordingly; to review vendor security activities to ensure their software development meets organization's standards; to coordinate, suggest remediations and perform revalidations to ensure identified security issues are timely closed; to prepare and update penetration testing reports/revalidation status reports as per organization's standard; to provide necessary information security guidance and support to internal and external stakeholders; to assist Department Head, Wing Head and Divisional Head in managing cyber defense at application and its architecture layer; and to perform any other assignment assigned by the supervisor(s).