Bank of Ceylon — Information Security Analyst Vacancies 2026
Bank of Ceylon
Bank of Ceylon is hiring two **Information Security Analyst** contract posts: **Security Assurance** and **Governance, Risk & Compliance (GRC)**. Age **28 or below**, UGC degree + relevant experience. Email CV to **careers@boc.lk** by **11 July 2026**. Selection: practical test + interview. 3-year fixed-term contract; negotiable remuneration.
Official apply / PDF https://www.boc.lk/careers/information-security-analyst-security-assurance/detailsPublished 2026 පොසොන් 28
Closing date 2026 ඇසළ 11
Organization Bank of Ceylon
Recruitment Timeline
Track every stage
- Completed
Email application deadline
2026 ඇසළ 11
Send CV to careers@boc.lk with the exact post name in the subject line.
- Completed
Practical test (shortlisted)
2026 ඇසළ 25
Shortlisted candidates undergo a practical test, then interview — dates notified by BOC HR.
Open posts
- 1. Information Security Analyst — Security Assurance (Contract) · AppSec audits, VA/PT, mobile security · Age ≤28 · Close 11 July 2026
- 2. Information Security Analyst — Governance, Risk & Compliance (GRC) (Contract) · Policies, ISO 27001 / PCI DSS, audits · Age ≤28 · Close 11 July 2026
- Related: Assistant Manager — Incident Response & SOC · Management Trainee.
Post 1 — Security Assurance
Key responsibilities
- Conduct application security audits and mobile application security audits.
- Run Vulnerability Assessments (VA) and Penetration Testing (PT).
- Security reviews and recommendations; information security policy & procedure reviews.
- Coordinate security awareness initiatives with internal stakeholders.
Eligibility
- Citizen of Sri Lanka; age 28 years or below as at the closing date.
- Route A: UGC-recognised bachelor's in Information Security / Cyber Security, or CS/IT specialised in InfoSec / Cyber Security + minimum 1 year professional experience in application security penetration testing and vulnerability assessment.
- Route B: UGC-recognised bachelor's in Computer Science or Information Technology + minimum 2 years professional experience in application security PT and VA.
Required skills
- Strong AppSec / SSDLC knowledge including OWASP Top 10, secure coding, and remediation.
- DevSecOps principles; PT across standalone, web, cloud, and containerised environments.
- Tools: Burp Suite, OWASP ZAP, Nessus and related assessment tools.
- Android / iOS mobile app PT experience; malware analysis & reverse engineering (static/dynamic) advantageous.
- Excellent communication, analytical, and report-writing skills for non-technical stakeholders.
Post 2 — Governance, Risk & Compliance (GRC)
Key responsibilities
- Support development, review, implementation, and monitoring of InfoSec policies, standards, and governance aligned with PCI DSS, ISO 27001, and regulatory requirements.
- Assist compliance with legal / industry requirements; coordinate security audits, assessments, and regulatory examinations.
- Support InfoSec risk assessments, identify control gaps, and monitor remediation.
- Coordinate awareness initiatives; prepare governance reports and track security metrics.
Eligibility
- Citizen of Sri Lanka; age 28 years or below as at the closing date.
- Route A: UGC-recognised bachelor's in Information Security / Cyber Security, or CS/IT specialised in InfoSec / Cyber Security + minimum 1 year professional experience in Information Security GRC.
- Route B: UGC-recognised bachelor's in Computer Science or Information Technology + minimum 2 years professional experience in Information Security GRC.
Required skills
- Strong understanding of ISO 27001, PCI DSS, and other security frameworks.
- Experience in InfoSec risk assessments & control evaluation; coordinating internal/external audits.
- Policy development & documentation; regulatory compliance awareness.
- Stakeholder management, analytical / problem-solving, time management, and report-writing skills.
Contract terms & selection
- Fixed-term contract: 3 years; performance reviewed annually.
- Negotiable, attractive remuneration based on candidate profile.
- Selection: practical test then interview for shortlisted candidates.
- Bank may call only shortlisted candidates; may postpone or cancel recruitment.
- Canvassing leads to immediate disqualification.
How to apply
- Email a complete, updated CV with qualifications, experience, and professional certifications to careers@boc.lk.
- Put the exact post name in the email subject (e.g. Information Security Analyst – Security Assurance).
- Acknowledge the Bank’s Personal Data Protection Notice for Recruitment in your email.
- Deadline: 11 July 2026. Late or ineligible applications are rejected without further notice.
- Official listing: boc.lk — Security Assurance · careers hub boc.lk/careers.
- Submit to: Deputy General Manager (Human Resource Operations), Human Resource Division, Bank of Ceylon, Colombo 01.
Frequently asked questions
What is the BOC Information Security Analyst closing date 2026?
11 July 2026 — email CV to careers@boc.lk with the post name in the subject line.
What BOC InfoSec Analyst posts are open?
Two contract posts: Information Security Analyst – Security Assurance, and Information Security Analyst – Governance, Risk and Compliance (GRC).
What is the age limit for BOC Information Security Analyst?
28 years or below as at the closing date of the application.
Is BOC Information Security Analyst permanent?
No — fixed-term contract for 3 years with annual performance review; remuneration is negotiable.
How is selection done for BOC InfoSec Analyst?
Shortlisted candidates sit a practical test, then an interview.
බැංකුවේ සිලෝන් තොරතුරු ආරක්ෂණ විශ්ලේෂක රැකියා 2026 — කෙසේ අයදුම් කරන්න?
CV එක careers@boc.lk වෙත ඊමේල් කරන්න; විෂය පේළියේ තනතුර සඳහන් කරන්න. අවසන් දිනය: 2026 ජූලි 11.
இலங்கை வங்கி தகவல் பாதுகாப்பு ஆய்வாளர் 2026 — எப்படி விண்ணப்பிப்பது?
CV ஐ careers@boc.lk க்கு அனுப்பவும்; பொருள் வரியில் பதவி பெயரை குறிப்பிடவும். காலக்கெடு: 11 ஜூலை 2026.
Related guides & exam tools
Official source
Structured hub page—always confirm eligibility, fees, and quotas on the government domain before you pay or submit documents.