Information Security Manager

The primary responsibility is to ensure that the company understands its obligations, submits accurate information on time, and remains continuously prepared for regulatory reviews.

This is a regulatory leadership role. Technical controls are implemented by the Global Information Security and Technology teams, and the Information Security Manager drives that work from the regulatory side: translating Mexican regulatory requirements into clear actions, coordinating delivery across those teams, validating evidence, and owning the final regulatory outcome.

The successful candidate combines senior regulatory judgment with disciplined execution. The role suits someone who works from verified facts, sees every issue through to closure, and plans ahead so that deliverables arrive ready on time.

Challenges That Await You: Regulatory Compliance

Monitor Mexican Information Security, cybersecurity, technology risk, business continuity, and related regulatory requirements applicable to The Company.

Maintain a complete register of regulatory obligations, reporting deadlines, responsible owners, required evidence, dependencies, and current status.

Interpret regulatory requirements and translate them into clear, actionable tasks for Information Security, Technology, Internal IT, Operations, Fraud Prevention, Business Continuity, and other responsible teams.

Assess the impact of regulatory changes and coordinate required updates to controls, processes, policies, procedures, and reporting.

Escalate regulatory risks, missing evidence, and potential delays before obligations become overdue.

Regulatory Reporting

Own the preparation and coordination of Information Security reports, formal responses, indicators, evidence packages, and information requests submitted to Mexican regulators.

Coordinate reporting related to CNBV, Banco de México, SPEI, and other applicable local supervisory activities within the scope of Information Security.

Verify all submitted information against source systems and supporting evidence.

Ensure that reports accurately identify the work performed, responsible owners, control status, findings, incidents, and remediation progress.

Maintain a clear audit trail of data sources, reviews, approvals, submissions, and regulator correspondence.

Act as the quality gate for everything submitted to management, auditors, and regulators, so it is complete, consistent, and backed by evidence.

Regulatory Engagement and Examinations

Act as the primary Information Security contact in Mexico for regulatory examinations, formal information requests, interviews, and follow-up activities.

Coordinate responses with the Global CISO, Legal, Compliance, Risk, Internal Audit, Technology, and other relevant stakeholders.

Prepare Company representatives for regulatory meetings and ensure that answers are consistent, accurate, and supported by evidence.

Track all commitments made to regulators until formally completed.

Keep the company exam-ready all year round, so each review or request starts from a solid, up-to-date position.

Audit and Assurance

Lead Information Security preparation for internal audits, regulatory reviews, SPEI assessments, PCI DSS activities, and other assurance exercises applicable to Mexico.

Maintain an evidence repository that is complete, current, and easy to validate.

Review evidence before submission and make sure every statement and control description is complete and supported.

Convert findings into remediation plans with clear owners, actions, deadlines, dependencies, and acceptance criteria.

Monitor remediation and escalate overdue or blocked actions.

Own the coordination of all Information Security audit and regulatory activities in Mexico from start to finish.

Information Security Governance

Represent Information Security before local management and control functions.

Provide clear reporting on regulatory exposure, control gaps, audit findings, incidents,