Information Security Analyst

Information Security Analyst – Bank of Ceylon

Job Overview

Bank of Ceylon (BOC), Sri Lanka’s leading state-owned commercial bank, is seeking qualified professionals for the position of Information Security Analyst (Security Assurance / Governance, Risk & Compliance – GRC) – Contract Basis. This role supports the bank’s cybersecurity framework by ensuring strong security controls, compliance with global standards, risk assessments, and continuous improvement of information security posture.

Position Details

Job Title: Information Security Analyst (Security Assurance / GRC)
Company: Bank of Ceylon
Location: Colombo District, Sri Lanka
Employment Type: Contract Basis
Category: Banking & Insurance, IT & Software, Security, Government Jobs

Company Overview

Bank of Ceylon is the largest banking institution in Sri Lanka with an extensive island-wide branch network and international operations. The bank is globally recognized among top banking brands and plays a critical role in strengthening Sri Lanka’s financial and digital ecosystem. It is committed to enhancing cybersecurity resilience and maintaining compliance with international security standards.

Qualifications & Experience

• Citizen of Sri Lanka
• Bachelor’s Degree in Information Security, Cyber Security, Computer Science, Information Technology or related field from a UGC-recognized university
• Minimum of 1–2 years of relevant experience in Information Security, Cyber Security, Risk Management, GRC, or Security Assurance
• Strong understanding of cybersecurity principles, governance frameworks, and risk management practices
• Exposure to standards such as ISO 27001, PCI-DSS, OWASP, or similar frameworks is an added advantage
• Experience in application security testing, vulnerability assessments, or audit compliance will be beneficial
• Professional certifications such as CISSP, CISM, CEH, GIAC (or equivalent) will be an added advantage

Key Responsibilities

• Conduct application security assessments and security audits
• Perform vulnerability assessments and penetration testing (where applicable)
• Review and evaluate security controls across systems and applications
• Support governance, risk, and compliance (GRC) activities across the organization
• Assist in development and implementation of information security policies and procedures
• Ensure compliance with regulatory requirements and internal security standards
• Support security awareness initiatives across business units
• Analyze security risks and recommend mitigation strategies
• Contribute to continuous improvement of security assurance processes
• Collaborate with internal teams including IT, Risk, Compliance, and Audit functions

Required Skills

• Strong knowledge of information security principles and best practices
• Understanding of secure software development lifecycle (SSDLC)
• Familiarity with penetration testing tools and vulnerability assessment tools
• Knowledge of OWASP Top 10 and application security concepts
• Strong analytical and risk assessment skills
• Good communication and documentation abilities
• Ability to work with cross-functional teams in a regulated environment
• Attention to detail and strong problem-solving mindset

Salary & Benefits

• Competitive contract-based remuneration package based on experience
• Opportunity to work in a leading national banking institution
• Exposure to enterprise-level cybersecurity and compliance frameworks
• Professional growth in Security Assurance and GRC domains
• Collaborative and highly structured work environment

How to Apply

Interested candidates should send their updated Curriculum Vitae along with academic qualifications, experience details, and professional certifications via email to:

Email: careers@boc.lk

Please mention “Information Security Analyst” in the subject line of the email.

Applications should be addressed to:
Deputy General Manager (Human Resource Operations)
Human Resource Division
Bank of Ceylon
Colombo 01

Important Notes

• Applications must be submitted on or before 11.07.2026
• Only shortlisted candidates will be contacted for the selection process
• Applicants must meet all required qualifications at the closing date
• Incomplete or late applications will not be considered
• The bank reserves the right to shortlist, postpone, or cancel the recruitment process without prior notice
• Canvassing in any form will lead to disqualification
• All applications will be treated with strict confidentiality according to bank policies